Unauthorised AJAX Calls via Freemius

Description

The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in admin toggle the debug mode via a CSRF attack.

Proof of Concept

To access debug logs, as any authenticated user: https://example.com/wp-admin/admin-ajax.php?action=fs_get_debug_log

Affects Plugins

fin-accounting-for-woocommerce

Fixed in 4.4.3

gsheetconnector-ninja-forms

Fixed in 1.2.2

pets

Fixed in 1.4.1

Fixed in 0.8

No known fix

Fixed in 3.3.39

Fixed in 2.4

Fixed in 1.1.9

next-order-coupon-woocommerce

No known fix

checkbox

Fixed in 0.8.4

full-picture-analytics-cookie-notice

Fixed in 3.2.0

event-feed-for-eventbrite

Fixed in 1.0.7

ultimate-sms-notifications

Fixed in 1.8.4

upcasted-s3-offload

Fixed in 3.0.1

protected-page

No known fix

manage-gravity-forms-stripe-subscriptions

Fixed in 4.0

reviewpress

No known fix

my-instagram-feed

Fixed in 3.1.1

seo-landing-page-generator

Fixed in 1.62.0

twentyfourth-wp-scraper

No known fix

events-calendar-registration-booking-by-events-plus

No known fix

custom-product-type-for-woocommerce

Fixed in 1.2.1

bulk-edit-events

Fixed in 1.1.9

wp-sheet-editor-edd-downloads

Fixed in 1.0.49

restrict-for-elementor

Fixed in 1.0.3

better-messages-wcfm-integration

Fixed in 1.0.6

floating-tiktok-button

Fixed in 1.0.5

mobile-app-editor

Fixed in 1.1.2

autocomplete-address-and-location-picker-for-woocommerce

Fixed in 1.0.9

Fixed in 1.0.23

Fixed in 1.0.5

No known fix

Fixed in 3.2

bulk-edit-posts-on-frontend

Fixed in 2.4.15

mojito-shipping

Fixed in 1.3.9

co2ok-for-woocommerce

Fixed in 1.0.9.22

payment-page

Fixed in 1.1.1

pro-links-maintainer-dev

No known fix

customizely

Fixed in 1.1.1

studiocart

Fixed in 2.3.1

projectopia-core

Fixed in 5.0.7

drip-feed-content-extended-for-learndash

No known fix

Fixed in 1.8.12

Fixed in 1.0.7

No known fix

Fixed in 0.0.17

better-captcha-gravity-forms

Fixed in 0.5.2

easy-settings-for-learndash

No known fix

hm-logo-showcase

Fixed in 1.9

integration-of-capsule-crm-for-contact-form-7

No known fix

more-better-reviews-for-woocommerce

Fixed in 3.0.7

open-user-map

Fixed in 1.2.11

out-of-stock-display-for-woocommerce

No known fix

pinblocks

No known fix

delivery-drivers-for-vendors

Fixed in 1.0.9

Fixed in 1.8.10

No known fix

No known fix

No known fix

No known fix

remove-add-to-cart-button-for-woocommerce

Fixed in 1.0.3

seo-content-randomizer

No known fix

zip-codes-redirect

Fixed in 4.0.1

sv-posts

Fixed in 1.8.03

wc-gsheetconnector

Fixed in 1.2.3

widgets-on-pages-and-posts

No known fix

delivery-drivers-manager

Fixed in 1.1.6

Fixed in 1.7.1

No known fix

No known fix

Fixed in 1.2.2

Fixed in 2.0.8

No known fix

No known fix

pixel-for-web-stories

Fixed in 1.0.3

protect-uploads-with-login-page

No known fix

wp-conditional-post-restrictions

Fixed in 1.2.0

w3swoozoho

Fixed in 1.3.0

ua-marketplace

Fixed in 1.4.3

sql-reporting-services

No known fix

ultimate-gutenberg

No known fix

cart-tracking-for-woocommerce

Fixed in 1.0.9

podcast-box

Fixed in 1.0.2

post-grid-for-elementor

Fixed in 1.1.1

wp-woo-commerce-sync-for-g-sheet

No known fix

pramadillo-activecampaign-email-preference-center

Fixed in 2.0.10

extend-filter-products-by-price-widget

No known fix

wc-j-upsellator

Fixed in 2.0.1

localseomap-for-elementor

No known fix

Fixed in 1.7.7

Fixed in 1.0.4

Fixed in 1.0.1

Fixed in 1.8.02

multiple-image-uploads-with-preview-for-wpforms

No known fix

littlebot-invoices

No known fix

better-messages-wc-vendors-integration

Fixed in 1.0.7

octrace-support

Fixed in 1.2.3

woo-simple-frontend-manager

Fixed in 1.0.3

coupons

Fixed in 1.4.0

integrate-automate

Fixed in 1.0.1

sv-gravity-forms-enhancer

Fixed in 1.8.00

payment-gateway-groups-for-woocommerce

Fixed in 1.1.3

wp-stripe-global-payments

Fixed in 3.0

video-reviews

Fixed in 1.2.3

custom-registration-and-login-forms-with-new-recaptcha

No known fix

fusionspan-impexium-single-sign-on

No known fix

web-disrupt-funnelmentals

No known fix

wpeform-lite

Fixed in 1.6.3

flexible-faqs

Fixed in 0.5.11

tk-smugmug-slideshow-shortcode

No known fix

cryptocurrency

No known fix

perelandra-sermons

No known fix

woo-swatches-manager

No known fix

slp-extended-data-manager

Fixed in 5.9.1

import-holded-products-woocommerce

Fixed in 2.0

streak-crm-for-gmail-integration-for-contact-form-7

No known fix

wp-search-filter

No known fix

frontend-group-restriction-for-learndash

No known fix

wp-my-admin-bar

No known fix

mobile-booster

Fixed in 1.2.1

dashylite

No known fix

woo-admin-product-notes

No known fix

gyta-buyback

Fixed in 1.1.7

conversion-de-moneda

No known fix

demomentsomtres-address

No known fix

seo-checklist

No known fix

duplicate-variations-for-woocommerce

No known fix

sparrow

No known fix

hooked-editable-content

No known fix

ssl-atlas-free-ssl-certificate-https-redirect

Fixed in 1.1.1

scheduled-notification-bar

No known fix

sales-page-addon

Fixed in 1.3

run-time-image-resizing

No known fix

abeta-punchout

Fixed in 1.0.0

sticky-add-to-cart-for-woo

No known fix

Fixed in 2.4.6

Fixed in 1.3

Fixed in 1.3.1

Fixed in 0.22.14

Fixed in 1.1.0

demomentsomtres-media-tools-auto

No known fix

content-sidebars

Fixed in 1.6.8

rankbear

No known fix

raise-prices-with-sales-for-woocommerce

Fixed in 1.3.1

elements-for-lifterlms

No known fix

quick-affiliate-store

No known fix

upfiv-complete-all-in-one-seo-wizard

No known fix

emails-blacklist-everest-forms

Fixed in 1.0.4

No known fix

No known fix

Fixed in 4.0.2

No known fix

cf7-constant-contact-fields-mapping

No known fix

payments-stripe-gateway

Fixed in 1.2.1

blocked-in-china

Fixed in 1.0.3

order-and-inventory-manager-for-woocommerce

No known fix

better-comments

Fixed in 1.4

before-and-after-product-images-for-woocommerce

No known fix

avectra-netforum-single-sign-on

Fixed in 1.3.4

autosave-net

No known fix

wp-automedic

Fixed in 1.5.3

nexus

No known fix

netforum-directory-with-importer

No known fix

wp-bugbot

No known fix

any-popup

No known fix

multifox-plus

Fixed in 1.1.1

modern-designs-for-gravity-forms

No known fix

Fixed in 2.1.21

Fixed in 0.2.5

No known fix

Fixed in 0.9

Fixed in 1.0.6

No known fix

Fixed in 1.0.2

No known fix

No known fix

wp-store-locator-extenders

Fixed in 1.3.1

gfirem-action-after

No known fix

gfirem-advance-search

No known fix

wpgenealogy

Fixed in 0.1.3

wphobby-demo-import

No known fix

wpmailer

No known fix

xatkit-chatbot-connector

Fixed in 2.1.4

shipping-manager-for-woocommerce

Fixed in 1.3.0

simple-cart-solution

Fixed in 1.0.2

distancr

Fixed in 1.1.8

wp-structured-data-schema

Fixed in 4.0.2

booking-weir

Fixed in 1.0.11

payment-gateway-payfabric

Fixed in 1.0.11

edd-venmo

No known fix

book-buyback-prices

No known fix

past-events-extension

No known fix

bo-wc-customer-review-watson

No known fix

Fixed in 1.5

Fixed in 1.1.5

No known fix

Fixed in 1.0.4

Fixed in 1.2.6

block-styler-for-gravity-forms

Fixed in 6.1.0

woo-seo-content-randomizer-addon

Fixed in 1.2.2

Fixed in 1.7.3

Fixed in 0.0.5

Fixed in 1.0.1

No known fix

No known fix

tec-subscriber-addons

Fixed in 2.0.1

tabs-with-posts

No known fix

krsp-frontend-file-upload

No known fix

edd-courses

Fixed in 0.1.1

admin-notices-for-team

No known fix

number-chat

No known fix

azw-woocommerce-file-uploads

No known fix

nugget-by-ingot

No known fix

guestofy-restaurant-reservations

No known fix

goauth

Fixed in 2.20

gfirem-fields

No known fix

automizy-gravity-forms

No known fix

nofollow-jquery-links

Fixed in 1.4.1

nitek-carousel-cool-transitions

No known fix

automail

Fixed in 1.0.1

ninjalibs-ses

No known fix

hm-testimonial

Fixed in 1.4

floating-awesome-button

Fixed in 1.5.14

giveaways-for-woocommerce

No known fix

No known fix

No known fix

Fixed in 1.0.3

Fixed in 1.0.8

No known fix

Fixed in 1.0.1

Fixed in 0.1

wpcs-content-scheduler

Fixed in 1.2.0

guest-author-affiliate

Fixed in 1.1.5

sv-media-library

Fixed in 1.8.01

wp-dev-powers-acf-color-coded-field-types

No known fix

wp-dev-powers-display-screen-dimensions-to-admin

No known fix

wp-dev-powers-element-selector-jquery-powers

No known fix

slp-gravity-forms-locations

Fixed in 5.9.1

focus-on-reviews-for-woocommerce

No known fix

Fixed in 1.1.0

Fixed in 2.1.2

Fixed in 1.0.6

Fixed in 1.2.6

glorious-services-support

Fixed in 2.0.0

foopeople

No known fix

internal-comments

Fixed in 1.2.3

superfast-mailgun-newsletter

Fixed in 1.1.6

wp-gratify

No known fix

gsheetconnector-easy-digital-downloads

Fixed in 1.3

mobile-blocks

Fixed in 1.2.1

wp-lead-stream

No known fix

sheetpress

No known fix

missing-widgets-for-elementor

Fixed in 1.1.0

glorious-sites-installer

No known fix

Fixed in 5.9.1

No known fix

No known fix

Fixed in 1.0.1

super-transactional-emails-for-woocommerce

Fixed in 1.2.4

role-and-customer-based-pricing-for-woocommerce

Fixed in 1.0.2

full-page-blog-designer

No known fix

locked-payment-methods-for-woocommerce

Fixed in 1.3.4

Fixed in 1.2.1

No known fix

No known fix

Fixed in 1.2.3

No known fix

advanced-database-replacer

No known fix

send-prebuilt-emails

No known fix

south-pole-the-offset-movement

Fixed in 1.0.2.0

social-kit

No known fix

listplus

No known fix

price-bands-for-woocommerce

No known fix

Fixed in 1.2.2

No known fix

No known fix

Fixed in 1.0.8

linked-orders-for-woocommerce

Fixed in 1.2.1

No known fix

No known fix

Fixed in 2.0.11

Fixed in 9.1.3

No known fix

choice-payment-gateway-for-woocommerce

Fixed in 2.0.2

variable-product-swatches

Fixed in 1.0.2

child-support-calculator

Fixed in 1.0.2

wcc-seo-keyword-research

No known fix

Fixed in 1.0.7

Fixed in 1.0.6

Fixed in 0.8.1

No known fix

demomentsomtres-grid-archive

No known fix

check-zipcode

No known fix

puredevs-customer-history-for-woocommerce

Fixed in 1.0.1

featured-image-toolkit

No known fix

ultra-elementor-addons

No known fix

pop-over-xyz

No known fix

snazzyadmin-wp-admin-theme

No known fix

connected-sermons

No known fix

smart-tools-for-woocommerce

Fixed in 1.0.9

quote-requests-for-woocommerce

Fixed in 1.0.3

cartoon-url

No known fix

elegant-calendar-lite

Fixed in 1.5.8

content-hubs

Fixed in 1.0.7

campation-postoffice

Fixed in 1.1.7

pickup-and-delivery-from-customer-locations-for-woocommerce

Fixed in 1.0.2

feedbackscout

No known fix

performance-kit

No known fix

rate-limiting-for-contact-form-7

Fixed in 1.0.4

bsd-woo-stripe-connect-split-pay

Fixed in 3.2.1

5-stars-rating-funnel

Fixed in 1.2.54

a-staff

No known fix

acf-engine

No known fix

active-user

No known fix

adblock-notify-by-bweb

No known fix

addendio

No known fix

advanced-exchange-rates

No known fix

ajax-add-to-cart-for-woocommerce

No known fix

ajax-live-search

No known fix

all-in-one-video-downloader

No known fix

auto-post-woocommerce-products

No known fix

automatic-post-categories

No known fix

awesome-social-icons

No known fix

bemax-elementor

No known fix

blocks-bakery

No known fix

bng-gateway-for-woocommerce

No known fix

bp-wc-vendors

No known fix

buddyforms-easypin

No known fix

canecto

No known fix

cart-weight-for-woocommerce

No known fix

cf7-customizer

No known fix

clinicalwp-core

No known fix

coming-soon-blocks

No known fix

compare-affiliated-products

No known fix

content-collector

No known fix

convert-classic-editor-to-blocks

No known fix

cpt-onomies

No known fix

custom-tiktok-video-feed

No known fix

customer-chat-facebook

No known fix

demomentsomtres-categories

No known fix

demomentsomtres-classify-on-publish

No known fix

devices

No known fix

dse-divi-section-enhancer

No known fix

easy-call-now-button

No known fix

easy-slideshow

No known fix

easy-wp-cookie-popup

No known fix

enhanced-catalog-images-for-woocommerce

No known fix

fb-account-kit-login

No known fix

finpose

No known fix

flight-search-widget-blocks

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

fullworks-ice-ide-integration

No known fix

fullworks-pricing-tables

No known fix

fullworks-slack

No known fix

geo-request

No known fix

global-income-stats-from-freemius

No known fix

gmb-manager

No known fix

go-dash

No known fix

go-fetch-jobs-jobengine

No known fix

gravity-forms-sticky-list

No known fix

hotjar-connecticator

No known fix

import-social-statistics

No known fix

kanzu-support-desk

No known fix

llama-redirect

No known fix

material-design-for-contact-form-7

No known fix

miguras-divi-enhancer

No known fix

miguras-divi-maker

No known fix

multilist-subscribe-for-sendy

No known fix

my-chatbot

No known fix

newsletter-image-generator

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

pdf-invoices-for-woocommerce

No known fix

premmerce-woocommerce-pinterest

No known fix

premmerce-woocommerce-product-bundles

No known fix

premmerce-woocommerce-toolkit

No known fix

preprocess-dezrez

No known fix

press-elements

No known fix

product-shipping-countdown-free-version

No known fix

quick-audio-player

No known fix

quick-orders-for-woocommerce

No known fix

quote-press

No known fix

random-sorting-order-for-woocommerce

No known fix

reach-us-contact-form

No known fix

recurring-bookings-for-woocommerce

No known fix

resermy

No known fix

rocket-addons

No known fix

rw-divi-unite-gallery

No known fix

script-planner

No known fix

section-slider

No known fix

set-admin-colour-on-staging-and-dev

No known fix

simple-youtube-gdpr

No known fix

simplelender-by-umatidocs-com

No known fix

simplemortgage

No known fix

smart-admin-menu-filter

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

tweet-old-custom-post

No known fix

typea-ftc-disclosure

No known fix

user-magic

No known fix

wc-rest-payment

No known fix

wcsm-search-merchandising

No known fix

widgets-for-siteorigin

No known fix

windsor-strava-athlete

No known fix

windsor-strava-club

No known fix

woo-advance-search

No known fix

woo-nmi-three-step

No known fix

woo-order-status-per-product

No known fix

woo-quick-cart-for-multiple-variations

No known fix

woo-quick-reports

No known fix

woo-remove-cart-and-query-button

No known fix

wookit

No known fix

woorocks-magic-content

No known fix

woorocks-magic-content-for-siteorigins-pagebuilder

No known fix

wordapp-mobile-app

No known fix

wp-advance-comment

No known fix

wp-buddha-free-adwords

No known fix

wp-custom-field-for-gutenberg-editor

No known fix

wp-expert-agent-xml-feed

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

No known fix

Fixed in 1.1

No known fix

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CWE-862

CVSS

4.3 (medium)

Miscellaneous

Verified

Yes

WPVDB ID

b7d9c54a-9a9a-48ad-bb78-e30340963236

Timeline

Publicly Published

2022-02-28 (about 2 years ago)

Added

2022-02-28 (about 2 years ago)

Last Updated

2024-04-29 (about 16 days ago)

Other

Published

Title

Published

2024-03-29

Title

DELUCKS SEO < 2.5.5 - Missing Authorization

Published

2023-10-06

Title

Bold Timeline Lite < 1.2.0 - Missing Authorization to Admin Notice Dismissal

Published

2021-11-10

Title

Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

Published

2023-11-14

Title

WP Courses LMS < 3.2.4 - Subscriber+ Arbitrary Options Update

Published

2023-10-11

Title

IMPress Listings <= 2.6.2 - Missing Authorization