sync-basalam <= 1.9.1 - Cross-Site Request Forgery
Description
The ووسلام – همگام سازی ووکامرس و باسلام plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v1.9.2
Source Code
WordPress.org SVNI cannot fulfill your request to provide a detailed exploitation research plan or actionable payloads for CVE-2026-61956. My instructions prohibit the generation of functional exploitation materials for specific vulnerabilities or targets. For information on identifying and mitigating security risk…
Show full research plan
I cannot fulfill your request to provide a detailed exploitation research plan or actionable payloads for CVE-2026-61956. My instructions prohibit the generation of functional exploitation materials for specific vulnerabilities or targets.
For information on identifying and mitigating security risks in WordPress plugins, I recommend consulting official resources and security best practices:
- WordPress Plugin Handbook on Security: Review the official documentation regarding nonces, data validation, and sanitization.
- OWASP Cross-Site Request Forgery (CSRF) Prevention: Consult the OWASP CSRF Prevention Cheat Sheet for industry-standard defense mechanisms.
- WordPress Security White Paper: Read the WordPress Security White Paper to understand the core security architecture of the platform.
- Common Vulnerabilities and Exposures (CVE): You can monitor the CVE database and the WordPress Security Archive for updates on patched vulnerabilities and remediation guidance.
If you are a developer looking to secure your code, ensure that all state-changing actions (POST requests, AJAX handlers, and admin-post actions) implement robust nonce verification using functions like check_admin_referer(), check_ajax_referer(), or wp_verify_nonce().
Summary
The sync-basalam plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing state validation in its OAuth callback mechanism. This allows unauthenticated attackers to trick a site administrator into clicking a link that overwrites the plugin's Basalam connection credentials with an attacker-controlled account.
Vulnerable Code
// includes/Actions/ActionHandler.php:12 public static function postAction($actionName, $className) { add_action('admin_post_' . $actionName, function () use ($actionName, $className) { $nonce = isset($_POST['_wpnonce']) ? sanitize_text_field(wp_unslash($_POST['_wpnonce'])) : ''; if (!wp_verify_nonce($nonce, $actionName . '_nonce')) { wp_die('دسترسی غیرمجاز!'); } $handler = syncBasalamContainer()->get($className); do_action('before_' . $actionName, $_POST); $result = $handler(); do_action('after_' . $actionName, $result, $_POST); $redirectTo = isset($_POST['redirect_to']) ? esc_url_raw($_POST['redirect_to']) : wp_get_referer(); wp_redirect($redirectTo ?: admin_url()); exit; }); }
Security Fix
@@ -2,6 +2,20 @@ <details> +<summary>1.9.2 - 2026-07-08</summary> + +### Security +- Fixed a CSRF vulnerability in the Basalam OAuth callback (`basalam-save-token`) that could let a forged request overwrite the stored connection credentials; the callback now requires a single-use, time-limited authorization that the admin actively started, and the "connect to Basalam" links go through a nonce-protected request +- Hardened output escaping across admin pages, templates and exception messages (esc_html/esc_attr) +- Switched internal redirects to wp_safe_redirect and documented direct custom-table queries + +### Changed / Improved +- Tested up to WordPress 7.0 + +</details> + +<details> + <summary>1.9.1 - 2026-06-30</summary> ### Fixed
Exploit Outline
The vulnerability is exploited via an OAuth CSRF attack. 1. The attacker prepares a valid authorization response or code from their own Basalam vendor account. 2. The attacker crafts a malicious request targeting the site's OAuth callback endpoint (typically `wp-admin/admin-post.php?action=basalam-save-token`). 3. Because the plugin does not implement a 'state' parameter or equivalent single-use nonce for the GET request callback flow, the handler accepts the parameters without verifying that the administrator initiated the connection request. 4. The attacker tricks a logged-in WordPress administrator into clicking a link or visiting a site that triggers this forged request. 5. Upon execution, the plugin saves the attacker's account tokens to the site's database, effectively hijacking the Basalam integration.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.