Missing Authorization / Broken Access Control

  • airflo

    (@airflo)


    2 weeks, 6 days ago

    Hi,

    I’m writing about CVE-2025-64294 (Missing Authorization / Broken Access Control to notice dismissal) in WP Snow Effect ≤ 1.1.19.

    The review-notice dismissal handler wp_snow_effect_set_no_bug() is hooked to admin_init and updates options when ?wpsenobug=1 is present. It does not check current_user_can() and does not verify a nonce. Because admin_init also runs on admin-ajax.php (no login redirect), this action can be triggered without proper authorization. wp_snow_effect_check_installation_date() has the same gap: it writes plugin options on admin_init without a capability check.

    Suggested fix:

    1. Move dismissal off admin_init to admin_post_wpse_dismiss_notice (do not register a nopriv hook).
    2. In the handler, require current_user_can( 'manage_options' ) and check_admin_referer( 'wpse_dismiss_notice' ).
    3. Build the “Leave Me Alone” URL with wp_nonce_url( admin_url( 'admin-post.php?action=wpse_dismiss_notice' ), 'wpse_dismiss_notice' ).
    4. Guard wp_snow_effect_check_installation_date() with current_user_can( 'manage_options' ) so unauthenticated/low-privilege requests cannot write options.

    Happy to provide a patch if that helps.

    Kind regards from Germany,

    Florian

You must be logged in to reply to this topic.