Executive Summary

The Petje.af plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 2.1.8. This occurs because the ajax_revoke_token() function, which handles the 'petjeaf_disconnect' AJAX action, does not validate a security nonce to confirm the request's legitimacy.

As a result, attackers can trick authenticated users into performing destructive actions such as revoking OAuth2 tokens, deleting user metadata, and deleting WordPress user accounts with the 'petjeaf_member' role by making them click on a malicious link or visit a malicious website.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized deletion of user accounts and associated data for users with the 'petjeaf_member' role. An attacker can exploit this by forcing authenticated users to unknowingly revoke OAuth2 tokens, delete user metadata, and remove their WordPress user accounts.

The impact includes loss of user access, potential disruption of services relying on these accounts, and possible data loss related to user metadata.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to force authenticated users to delete their Petje.af member user accounts via forged requests. This could lead to unauthorized account deletions and potential loss of user data integrity.

However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0