WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery

mediumseverity

0.5%likelihood of exploitation, next 30 days

45%of all CVEs are less likely

Readycheck to confirm it

Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link.

Impact

Attackers can modify plugin settings without authorization, potentially leading to site defacement or malicious content injection.

Fix

Implement CSRF tokens and verify requests properly, update to the latest plugin version.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: POST /wp-admin/admin-post.php?action=sgpbSaveSettings
Positive when: status_code == 302 and contains(header, "page=sgpbSettings") && contains(header, "post_type=popupbuilder")

Run it with nuclei: nuclei -id CVE-2022-29495 -u <target>

The full check

id: CVE-2022-29495

info:
  name: WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
  author: Shivam Kamboj
  severity: medium
  description: |
    Sygnoos Popup Builder plugin <= 4.1.11 for WordPress contains a cross-site request forgery caused by lack of CSRF protection in plugin settings update, letting attackers change settings without authorization, exploit requires victim to visit malicious site or click malicious link.
  impact: |
    Attackers can modify plugin settings without authorization, potentially leading to site defacement or malicious content injection.
  remediation: |
    Implement CSRF tokens and verify requests properly, update to the latest plugin version.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29495
    - https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-11-cross-site-request-forgery-csrf-leading-to-plugin-settings-update
  metadata:
    verified: true
    max-request: 2
    publicwww-query: "plugins/popup-builder"
  tags: cve,cve2022,wordpress,wp-plugin,popup-builder,csrf,authenticated,wp

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-post.php?action=sgpbSaveSettings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        sgpb-enable-debug-mode=on&sgpb-dont-delete-data=on&sgpb-disable-analytics-general=on

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "page=sgpbSettings") && contains(header, "post_type=popupbuilder")'
        condition: and

    extractors:
      - type: regex
        part: header
        regex:
          - "Location: (.+)"
        group: 1

References

Use this check only on systems you are authorised to test. Where the data comes from