CVE-2023-30486 PoC — WordPress Square theme <= 2.0.0 - Broken Access Control

Source

https://github.com/RandomRobbieBF/CVE-2023-30486

Associated Vulnerability

Title:WordPress Square theme <= 2.0.0 - Broken Access Control (CVE-2023-30486)
Description:Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

Description

Square <= 2.0.0 - Missing Authorization via activate_plugin

Readme

# CVE-2023-30486
Square &lt;= 2.0.0 - Missing Authorization via activate_plugin

# Description
  
The Square theme for WordPress is vulnerable to unauthorized plugin activation due to a missing capability check on the activate_plugin function called via an AJAX action in versions up to, and including, 2.0.0. This makes it possible for authenticated attackers , with subscriber-level access and above, to activate arbitrary plugins.


```
Missing Authorization
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE 	CVE-2023-30486
CVSS 	4.3 (Medium)
Publicly Published 	April 13, 2023
Last Updated 	January 22, 2024
Researcher 	Dave Jong - Patchstack
```

Links
---

https://patchstack.com/database/vulnerability/square/wordpress-square-theme-2-0-0-broken-access-control


https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=177729%40square&new=177729%40square&sfp_email=&sfph_mail=

POC
---

```
$ python3 CVE-2023-30486.py -u http://kubernetes.docker.internal -un user -p user
Logged in successfully.
hashthemes-demo-importe installed
```

Notes
---
Pointless CVE but i thought it would be fun to do a POC seems to only work if the hashthemes-demo-importer has never been installed before.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!