Unauthenticated REST API Access in WowOptin WordPress Plugin

Executive Summary

The WowOptin WordPress plugin before version 1.4.38 has a flaw in a REST endpoint that allows unauthenticated users to disable all opt-in forms on a site and insert new template-based opt-in rows. This happens because the endpoint uses a weak permission check that grants access without requiring authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if the WowOptin plugin version is below 1.4.38 by inspecting the plugin files or WordPress admin panel. Look for unauthorized changes to opt-in forms or new template-based rows in the database. Monitor network traffic for suspicious requests to the REST endpoint /wp-json/optn/v1/recipes/<id> with parameters like disable_others=1 or status=1.

Useful 0 Not Useful 0

Impact Analysis

An attacker could disable all existing opt-in forms on your WordPress site, preventing visitors from subscribing or interacting with them. They could also inject new opt-in forms from templates, potentially redirecting users or collecting data without your consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized changes to opt-in forms, potentially exposing user data collection without proper consent. It may also violate data protection requirements if new forms are injected without user knowledge.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WowOptin plugin to version 1.4.38 or later immediately. If updating is not possible, disable the plugin until the update is applied. Review all opt-in forms for unauthorized changes and remove any suspicious new rows. Implement strict access controls on the REST endpoint and monitor for unauthorized access attempts.

Useful 0 Not Useful 0