WordPress Nictitate Theme <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF)
Claim ownership and start a managed Vulnerability Disclosure Program.
Apply for mVDP
Vulnerability description
Dhabaleshwar Das discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Nictitate Theme to Patchstack.
See tips for patching this kind of vulnerabilityHow to reproduce
The "Nictitate" theme lacks proper nonce implementation for the "dismiss_admin_notices" action, exposing users to Cross-Site Request Forgery (CSRF) attacks. This vulnerability could allow an attacker to perform malicious actions on behalf of the authenticated user without their consent.
1- First install the "Nictitate" theme and then activate it.
2- After activation, you would see a notice on top of the page, "This theme requires the following plugin: Kopa Nictitate Toolkit..........." just click on "Dismiss this notice" and then intercept the request, you'll see that no nonce is implemented in the request.
3- This absence of nonce causes CSRF attacks, wherein an attacker can forge a request to perform unauthorized actions on behalf of the user who is currently authenticated.
The crafted HTML request can be seen here:
<html>
<!-- CSRF PoC --->
<body>
<script>history.pushState('', '', '/')</script>
<form action="http://localhost/wordpress/wp-admin/themes.php">
<input type="hidden" name="tgmpa-dismiss" value="dismiss_admin_notices" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
See researcher files below
How to disclose
To make the patching process easier and safer for all users, we recommend reading our memo about the most common vulnerabilities and the way these can be fixed. If you need help understanding some of the security concepts, don’t worry. That’s when we step in and help.
Please send us the patched version or code before releasing it, so we could help you avoid incomplete patches that could lead to inconveniences. Don’t delay security patch releases for other non-security updates. Ideally, security fixes would be released separately so users could update ASAP without fear of anything breaking. You can also join the free Patchstack mVDP program to have better control over the vulnerability patching and disclosure process.
Dhabaleshwar Das
Provide link to fix
