CVE-2022-4604 (published 2022-12-18T11:15Z)

A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoints of the file english-wp-admin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.5.2 is able to address this issue. The name of the patch is ad4ba171c974c65c3456e7c6228f59f40783b33d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216199.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/khromov/wp-english-wp-admin
commit_details: repo_url: https://github.com/khromov/wp-english-wp-admin
author: Stanislav Khromov
author_date: 2022-02-23 23:28:03+01:00
msg: Fix vulnerability
repository: repo_url: https://github.com/khromov/wp-english-wp-admin
repo_name: khromov/wp-english-wp-admin
description: Lets users change their administration language to English (WordPress plugin)
repo_language: PHP
owner: khromov
file_changes: filename: english-wp-admin.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 Plugin Name: English WordPress Admin
 Plugin URI: http://wordpress.org/plugins/english-wp-admin
 Description: Lets users change their administration language to English
-Version: 1.5.1
+Version: 1.5.2
 Author: khromov
 Author URI: http://snippets.khromov.se
 GitHub Plugin URI: khromov/wp-english-wp-admin
@@ -89,15 +89,17 @@ class Admin_Custom_Language
 	{
 		//We're in admin
 		if(is_admin()) {
-			//Is the GET variable set?
-			if(isset($_GET['admin_custom_language_toggle'])) {
+			
+			//Is the GET variables required set?
+			if(isset($_GET['admin_custom_language_toggle']) && isset($_GET['nonce'])) {
+
 				//Cast variable
 				$cookie_value = intval($_GET['admin_custom_language_toggle']);
 
 				//Set cookie
 				$cookie_value === 1 ? $this->set_cookie(1) : $this->set_cookie(0);
 
-				if(isset($_GET['admin_custom_language_return_url'])) {
+				if(isset($_GET['admin_custom_language_return_url']) && wp_verify_nonce( $_GET['nonce'], 'english_wordpress_admin_redirect')) {
 					wp_redirect(urldecode($_GET['admin_custom_language_return_url']));
 				}
 				else {
@@ -254,12 +256,15 @@ class Admin_Custom_Language
 	{
 		//We're in admin and this is not a WPML install
 		if(is_admin() && apply_filters('english_wordpress_admin_show_admin_bar', true) === true) {
+			
 			//Sets up the toggle link
+			$toggle_nonce = wp_create_nonce('english_wordpress_admin_redirect');
+
 			if($this->in_url_whitelist()) {
 				$toggle_href =  plugin_dir_url( __FILE__ ) . 'readme.txt';
 			}
 			else {
-				$toggle_href = admin_url('?admin_custom_language_toggle=' . ($this->english_admin_enabled() ? '0' : '1') . '&admin_custom_language_return_url=' . urlencode((is_ssl() ? 'https' : 'http') . '://' . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]));
+				$toggle_href = admin_url('?admin_custom_language_toggle=' . ($this->english_admin_enabled() ? '0' : '1') . '&nonce=' . $toggle_nonce . '&admin_custom_language_return_url=' . urlencode((is_ssl() ? 'https' : 'http') . '://' . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]));
 			}
 
 			//Create toggle title

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ Contributors: khromov
 Tags: english, wpml, multilanguage
 Requires at least: 3.5
 Tested up to: 5.3
-Stable tag: 1.5.1
+Stable tag: 1.5.2
 License: GPL2
 
 Lets users change their administration language to English
@@ -100,6 +100,10 @@ You can leave feature requests in the plugin support forum.
 
 == Changelog ==
 
+= 1.5.2 =
+
+* Fix for unauthenticated open redirect vulnerability
+
 = 1.5.1 =
 
 * Fix for PHP 5.2

programming_language: Markdown