Taqnix WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Account Deletion

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Taqnix plugin for WordPress, affecting all versions through 1.0.3. The issue arises from a lack of proper nonce verification in the 'taqnix_delete_my_account' AJAX action, where the nonce check has been commented out. This flaw enables unauthenticated attackers to manipulate logged-in non-administrator users into deleting their accounts by sending a forged request, provided they can entice the user to click a link or visit a malicious page.

Impact

Exploitation of this vulnerability allows for unauthorized account deletion of non-administrator users.

Reproduction

To reproduce this vulnerability, an attacker must send a request to the 'taqnix_delete_my_account' AJAX action without a valid nonce. This can be done by tricking a logged-in non-administrator user into clicking a link or visiting a page that triggers the request, such as through social engineering or by embedding the request in a script or image.

Remediation

Users are advised to update the Taqnix WordPress plugin to version 1.0.4 or later, where this vulnerability has been patched.