Headline
CVE-2023-0584: class-vk-blocks-font-awesome-api.php in vk-blocks/trunk/inc/vk-blocks/font-awesome – WordPress Plugin Repository
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST ‘update_options’ function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the ‘vk_font_awesome_version’ option to an arbitrary value.
Last change on this file was 2799829, checked in by , 8 months ago
Update to version 1.44.0.0 from GitHub
File size: 1.5 KB
Line
1
<?php
2
/**
3
* VK Font Awesome API
4
*
5
* @package VK Blocks
6
*/
7
8
use VektorInc\VK_Font_Awesome_Versions\VkFontAwesomeVersions;
9
10
/**
11
* VK Font Awesome API
12
*/
13
class VK_Blocks_Font_Awesome_API {
14
15
/\*\*
16
\* Constructor
17
\*/
18
public function \_\_construct() {
19
// Register REST API route.
20
add\_action( 'rest\_api\_init', array( $this, 'register\_routes' ) );
21
}
22
23
/\*\*
24
\* Register REST API route
25
\*/
26
public function register\_routes() {
27
register\_rest\_route(
28
'vk-blocks/v1',
29
'/options/vk\_font\_awesome\_version/',
30
array(
31
array(
32
'methods' \=> 'GET',
33
'callback' \=> array( $this, 'get\_options' ),
34
'permission\_callback' \=> array( $this, 'permission\_callback' ),
35
),
36
array(
37
'methods' \=> 'POST',
38
'callback' \=> array( $this, 'update\_options' ),
39
'permission\_callback' \=> array( $this, 'permission\_callback' ),
40
),
41
)
42
);
43
}
44
45
/\*\*
46
\* Permission Callback
47
\*/
48
public function permission\_callback() {
49
return current\_user\_can( 'edit\_posts' );
50
}
51
52
/\*\*
53
\* Get options
54
\*
55
\* @return WP\_REST\_Response|WP\_Error
56
\*/
57
public function get\_options() {
58
$options \= VkFontAwesomeVersions::get\_option\_fa();
59
return rest\_ensure\_response( $options );
60
}
61
62
/\*\*
63
\* Update options
64
\*
65
\* @param string $request JSON.
66
\*/
67
public function update\_options( $request ) {
68
$options \= $request\->get\_json\_params();
69
update\_option( 'vk\_font\_awesome\_version', $options );
70
return rest\_ensure\_response(
71
array(
72
'status' \=> 'success',
73
'message' \=> \_\_( 'Setting saved.', 'vk-blocks' ),
74
)
75
);
76
}
77
}
Note: See TracBrowser for help on using the repository browser.