Details ================ Software: Member Approval Version: 131109 Homepage: http://wordpress.org/plugins/member-approval/ Advisory ID: dxw-1970-1172 CVE: CVE-2014-3850 CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N) Description ================ CSRF in Member Approval 131109 permits unapproved registrations Vulnerability ================ By convincing a logged-in administrator to visit a link of an attacker&#8217;s choosing an attacker can reset the plugin&#8217;s options to the defaults, meaning that registrations will become open to everybody without requiring approval. Proof of concept ================ By clicking the submit button here, an admin will reset the plugin to the defaults (with some slight modifications there may be a stored XSS here too, but I did not investigate further): <form method=\"post\" action=\"http://localhost/wp-admin/options-general.php?page=member-approval\";> <input type=\"submit\"> </form> Note: no admin action is necessary assuming the attacker can persuade an admin to visit a page under their control, as the form can be submitted using Javascript. Mitigations ================ Disable the plugin until a fix is available. Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/ Please contact us on security () dxw com to acknowledge this report if you received it via a third party (for example, plugins () wordpress org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2014-04-08: Discovered 2014-04-10: Reported to plugins () wordpress org 2014-06-10: No response from author. Published. Discovered by dxw: ================ Tom Adams ======= Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information.