Member Approval 131109 permits unapproved registrations CSRF

Credit: Tom Adams
Risk: Low
Local: No
Remote: Yes

Details ================ Software: Member Approval Version: 131109 Homepage: Advisory ID: dxw-1970-1172 CVE: CVE-2014-3850 CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N) Description ================ CSRF in Member Approval 131109 permits unapproved registrations Vulnerability ================ By convincing a logged-in administrator to visit a link of an attacker&#8217;s choosing an attacker can reset the plugin&#8217;s options to the defaults, meaning that registrations will become open to everybody without requiring approval. Proof of concept ================ By clicking the submit button here, an admin will reset the plugin to the defaults (with some slight modifications there may be a stored XSS here too, but I did not investigate further): <form method=\"post\" action=\"http://localhost/wp-admin/options-general.php?page=member-approval\";> <input type=\"submit\"> </form> Note: no admin action is necessary assuming the attacker can persuade an admin to visit a page under their control, as the form can be submitted using Javascript. Mitigations ================ Disable the plugin until a fix is available. Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: Please contact us on security () dxw com to acknowledge this report if you received it via a third party (for example, plugins () wordpress org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2014-04-08: Discovered 2014-04-10: Reported to plugins () wordpress org 2014-06-10: No response from author. Published. Discovered by dxw: ================ Tom Adams ======= Discovered by dxw: ================ Tom Adams Please visit for more information.


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019,


Back to Top