Kirim.Email WooCommerce 集成 <= 1.2.9 - 对设置更新的跨站请求伪造 (Cross-Site Request Forgery to Settings Update)

Successful exploitation of this CSRF vulnerability allows an attacker to forge requests that appear to originate from a legitimate administrator. This enables them to modify critical plugin settings, such as API keys and integration configurations, without proper authentication. Compromising these settings could lead to unauthorized sending of emails, data breaches if API keys grant access to sensitive information, and potential disruption of WooCommerce order processing. The attacker needs to trick an administrator into clicking a malicious link or visiting a crafted page to trigger the forged request.

WordPress sites utilizing the Kirim.Email WooCommerce Integration plugin, particularly those with shared hosting environments or legacy configurations where administrator access is not strictly controlled, are at risk. Sites where administrators frequently click on links from untrusted sources are also more vulnerable.

• wordpress / composer / npm:

grep -r 'kirim_email_settings' /var/www/html/wp-content/plugins/

• wordpress / composer / npm:

wp plugin list --status=all | grep Kirim.Email

• generic web: Check for unusual API key changes in WooCommerce email settings. Monitor WordPress admin activity logs for suspicious requests to the Kirim.Email plugin settings page.

1. 2025-12-12Disclosure

   disclosure

1. 已保留2025-12-05
2. 发布日期2025-12-12
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation is to upgrade the Kirim.Email WooCommerce Integration plugin to version 1.3.0 or later, which includes the necessary nonce validation. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) rule to block suspicious requests targeting the plugin's settings endpoint. Carefully review user permissions and restrict access to the plugin's settings page to only authorized administrators. Regularly audit the plugin's configuration for any unauthorized changes.