WordPress Plugin Vulnerabilities
Greeklish-permalink < 3.5 - Unauthenticated Post Slug Update
Description
The plugin does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
Proof of Concept
1. Create a post with the name "Νέα ανάρτηση".
2. Visit the post and notice that the permalink uses the Greek characters.
3. In an unauthenticated browser session, run the following code: fetch('/wp-admin/admin-ajax.php?action=cyrtrans_ajax_old', {method: 'POST'})
4. Visit the post again, and notice that the permalink now uses Latin characters.
Affects Plugins
Fixed in 3.5 References
CVE
Classification
Type
PRIVESC
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Jonas Höbenreich
Submitter
Jonas Höbenreich
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-06-19 (about 5 months ago)
Added
2023-06-19 (about 5 months ago)
Last Updated
2023-08-15 (about 3 months ago)
WPScan 