Eyewear Prescription Form WordPress Plugin Missing Authorization Vulnerability Allows Unauthenticated WooCommerce Product Creation

A vulnerability exists in the Eyewear Prescription Form plugin for WordPress, affecting all versions up to and including 6.0.1. The issue stems from missing authorization checks on the 'SubmitCatProductRequest' AJAX action, which enables unauthenticated users to create arbitrary WooCommerce products. Exploitation can be achieved by sending custom names, prices, and category assignments through the 'Name', 'Price', and 'Parent' parameters.

Impact

Exploitation of this vulnerability allows for the unauthorized creation of WooCommerce products, potentially leading to misuse of the e-commerce platform.

Reproduction

To reproduce this vulnerability, send a request to the 'admin-ajax.php' endpoint with the 'action' parameter set to 'SubmitCatProductRequest'. Include the 'Name', 'Price', and 'Parent' parameters in the request. The absence of authorization checks will allow the creation of a new WooCommerce product with the specified details.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.