GSheetConnector For Gravity Forms WordPress Plugin Authorization Bypass Vulnerability Allowing Arbitrary Plugin Installation

A vulnerability exists in the GSheetConnector For Gravity Forms WordPress plugin, specifically in versions through 1.3.27. The issue arises from a missing capability check in the 'install_plugin' function, allowing authenticated users with subscriber-level access or higher to bypass authorization. This flaw enables these users to install plugins on the affected site, potentially leading to arbitrary code execution on the server under certain conditions.

Impact

Exploitation of this vulnerability could result in unauthorized plugin installations, which may be used to execute arbitrary code on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access must send a request to the 'install_plugin' AJAX endpoint. The request must include the 'plugin_slug' and 'download_url' parameters. The absence of a proper capability check allows the user to install any plugin, regardless of their authorization level.

Remediation

Users are advised to update the GSheetConnector For Gravity Forms WordPress plugin to version 1.3.28 or later.