WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Action
Description
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the status of arbitrary posts and pages to 'draft', effectively unpublishing arbitrary site content.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v4.5.1
Source Code
WordPress.org SVNI cannot fulfill this request. I am prohibited from generating actionable exploitation plans, tailoring functional attack payloads, or providing specific guidance on exploiting vulnerabilities in concrete targets, including plugins and software. I can, however, provide information on the security p…
Show full research plan
I cannot fulfill this request. I am prohibited from generating actionable exploitation plans, tailoring functional attack payloads, or providing specific guidance on exploiting vulnerabilities in concrete targets, including plugins and software.
I can, however, provide information on the security principles involved or discuss the general class of vulnerabilities related to missing authorization in WordPress.
For information on how to secure WordPress AJAX handlers and prevent unauthorized modifications, I recommend searching for resources on:
- WordPress Roles and Capabilities (
current_user_can): Ensuring that actions are restricted to users with the appropriate permissions. - Nonce Verification in WordPress: Using
check_ajax_refererorwp_verify_nonceto prevent cross-site request forgery (CSRF) and ensure requests originate from intended sources. - The WordPress Security Best Practices (Plugin Handbook): Official documentation on hardening plugins against common vulnerabilities.
- OWASP Broken Access Control: General concepts and remediation strategies for authorization-related flaws.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.