Description
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync()` callback registered via `wp_ajax_nopriv_handle_sync` in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated attackers to force the WordPress server to issue outbound HTTP requests to the plugin vendor's external API (`https://www.layoutsforwpbakery.com/wp-json/layoutsforwpbakery/v1/{templates,categories}`) and to write the JSON-decoded responses verbatim into the site's `wp_options` table via `set_transient()` — at any rate the attacker chooses, with no nonce verification, capability check, or rate limiting.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
techeshta Layouts for WPBakery
Default version status: unaffected
0 to ≤ 1.1.3affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/2beaf82f-3709-48de-bcc2-535479c4fafe?source=cve ↗
- https://wordpress.org/plugins/layouts-for-wpbakery/ ↗
- https://plugins.trac.wordpress.org/browser/layouts-for-wpbakery/trunk/includes/api/class-layouts-remote.php#L46 ↗
- https://plugins.trac.wordpress.org/browser/layouts-for-wpbakery/trunk/includes/api/class-layouts-remote.php#L53 ↗
- https://plugins.trac.wordpress.org/browser/layouts-for-wpbakery/trunk/includes/class-layout-importer.php#L25 ↗
- https://plugins.trac.wordpress.org/changeset?new=3543686%40layouts-for-wpbakery%2Ftrunk&old=3543685%40layouts-for-wpbakery%2Ftrunk ↗