WordPress Plugin Vulnerabilities

Greeklish-permalink < 3.5 - Unauthenticated Post Slug Update

Description

The plugin does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.

Proof of Concept

1. Create a post with the name "Νέα ανάρτηση".

2. Visit the post and notice that the permalink uses the Greek characters.

3. In an unauthenticated browser session, run the following code: fetch('/wp-admin/admin-ajax.php?action=cyrtrans_ajax_old', {method: 'POST'})

4. Visit the post again, and notice that the permalink now uses Latin characters.

Affects Plugins

References

Classification

Miscellaneous

Original Researcher
Jonas Höbenreich
Submitter
Jonas Höbenreich
Submitter website
Verified
Yes

Timeline

Publicly Published
2023-06-19 (about 1 years ago)
Added
2023-06-19 (about 1 years ago)
Last Updated
2023-08-15 (about 10 months ago)

Other