A newly discovered vulnerability has been found within the popular WordPress plugin, The Restaurant Menu – Food Ordering System – Table Reservation, which allows authenticated attackers to bypass authorization controls and gain potentially unauthorized access to several AJAX actions supported in the plugin.

The vulnerability, referenced as CVE-2022-2696, has been identified to impact versions of the plugin, up to and including version 2.3.. Missing capability checks and the absence of nonce validation (nonce is a number that should only be used once) in the plugin are the root causes of this vulnerability. Consequently, malicious users with minimal permissions could perform unauthorized actions, including, but not limited to altering plugin settings and modifying food ordering system preferences.

Exploit Details

Authenticated attackers could exploit this vulnerability by performing unauthorized actions as the insecure AJAX (Asynchronous JavaScript and XML) actions are exposed. AJAX is a group of interrelated technologies utilized for creating dynamic web applications.

To exploit the vulnerability, attackers must first gain access to the WordPress site with standard user permissions. After that, attackers could manipulate AJAX calls to change the plugin settings and food ordering preferences, among other things.

Here's a typical AJAX call from the plugin that lacks both capability checks and nonce validation

add_action("wp_ajax_nopriv_RM_AJAX_ACTION", "RM_AJAX_ACTION");
add_action("wp_ajax_RM_AJAX_ACTION_AJAX_ACTION", "RM_AJAX_ACTION");

As this AJAX call is exposed to unauthorized users, the plugin's settings could be modified to include malicious content or redirect site visitors to illegitimate websites.

To address the vulnerability, the plugin developers must implement and enforce strict nonce validation and capability checks for every AJAX action. Doing so can significantly improve the security level and mitigate the risk of unauthorized access.

function RM_AJAX_ACTION(){
    if ( !isset($_REQUEST['nonce']) || ! wp_verify_nonce($_REQUEST['nonce'], 'RM_AJAX_ACTION_nonce') ){
        // If nonce check fails, display an error message.
        die('Unauthorized Request.');
    }
     
    if ( ! current_user_can( 'manage_options' ) ) {
        // If user does not have the necessary capabilities, deny access.
        die('You do not have permissions to perform this action.');
    }
   
    // Carry out the requested action here.
}

Original References

- To refer to the official CVE entry, check out the following link: CVE-2022-2696
- For an in-depth explanation of nonce validation and capability checks in WordPress, please visit: WordPress Nonce Generation and Verification

Conclusion

The CVE-2022-2696 vulnerability exposes the Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress to an authorization bypass for actions in the plugin's AJAX actions. The vulnerable plugin versions are up to and including 2.3., and the absence of strictly enforced nonce validation and capability checks could result in unauthorized actions.

Web administrators who employ the Restaurant Menu – Food Ordering System – Table Reservation plugin should ensure they are running the most up-to-date plugin version and keep an eye out for any security patches released by the developers.

As responsible web users, it is essential to stay informed of security vulnerabilities in any plugins we use and keep our software regularly updated. By doing so, we can maintain a high-security standard and protect the information of our website's users.

Timeline

Published on: 11/03/2022 17:15:00 UTC
Last modified on: 11/04/2022 02:19:00 UTC