MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion
Description
The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's integration settings, delete all plugin options, and drop the plugin's database tables (woo_mailerlite_carts and woo_mailerlite_jobs), resulting in complete loss of plugin data including customer abandoned cart information and sync job history.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NTechnical Details
<=3.1.3Source Code
WordPress.org SVNI cannot fulfill this request. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating actionable exploitation plans, proof-of-concept exploit code, or detailed research plans designed to exploit specific vulnerabilities in software, including Word…
Show full research plan
I cannot fulfill this request. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating actionable exploitation plans, proof-of-concept exploit code, or detailed research plans designed to exploit specific vulnerabilities in software, including WordPress plugins.
If you are interested in learning about WordPress security from a defensive perspective, I can provide general information on:
- Capability Checks: How to use the
current_user_can()function to ensure only authorized users can access sensitive plugin features. - Nonce Implementation: How to properly implement WordPress nonces (
wp_create_nonceandwp_verify_nonce) to protect against Cross-Site Request Forgery (CSRF). - Secure AJAX Handling: Best practices for registering AJAX actions (
wp_ajax_vswp_ajax_nopriv_) and validating requests. - Database Security: How to safely interact with the WordPress database using
$wpdb->prepare()to prevent SQL injection.
For further research into secure development practices, I recommend consulting the WordPress Plugin Handbook's Security section or the OWASP Top 10 for general web application security principles.
Summary
The MailerLite – WooCommerce integration plugin fails to perform authorization checks and nonce verification on its resetIntegration function. This allows authenticated attackers, such as Subscribers, to reset all plugin settings and permanently delete database tables containing abandoned cart and sync job data.
Security Fix
@@ -100,6 +100,12 @@ public function resetIntegration() { + if ( ! current_user_can( 'manage_options' ) ) { + wp_send_json_error( 'Unauthorized', 403 ); + } + + check_ajax_referer( 'mailerlite_woocommerce_admin', 'nonce' ); + global $wpdb; // Logic to delete options and drop tables $wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}woo_mailerlite_carts"); $wpdb->query("DROP TABLE IF EXISTS {$wpdb->prefix}woo_mailerlite_jobs");
Exploit Outline
An attacker must first authenticate as a Subscriber or any user role. The exploit involves sending a crafted AJAX request to the WordPress admin-ajax.php endpoint. The payload must include the 'action' parameter mapped to the resetIntegration function (e.g., 'mailerlite_reset_integration'). Because the function lacks a call to current_user_can() and does not verify a cryptographic nonce, the plugin executes the reset logic, clearing the 'mailerlite_woocommerce_settings' option and executing SQL commands to drop the 'woo_mailerlite_carts' and 'woo_mailerlite_jobs' tables.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.