CVE-2022-0215 Overview
CVE-2022-0215 is a Cross-Site Request Forgery (CSRF) vulnerability affecting three WordPress plugins developed by XootiX: Login/Signup Popup, Waitlist Woocommerce (Back in stock notifier), and Side Cart Woocommerce (Ajax). The flaw resides in the save_settings function within ~/includes/xoo-framework/admin/class-xoo-admin-settings.php, which lacks proper nonce validation. Attackers can trick an authenticated administrator into submitting a forged request that updates arbitrary site options. Successful exploitation enables creation of a new administrative user, granting full control over the compromised WordPress site. Wordfence reported that approximately 84,000 WordPress sites were affected at the time of disclosure.
Critical Impact
Successful CSRF exploitation lets unauthenticated attackers modify arbitrary WordPress options and elevate to administrative access on vulnerable sites.
Affected Products
- XootiX Login/Signup Popup — versions <= 2.2
- XootiX Waitlist Woocommerce (Back in stock notifier) — versions <= 2.5.1
- XootiX Side Cart Woocommerce (Ajax) — versions <= 2.0
Discovery Timeline
- 2022-01-18 - CVE-2022-0215 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2022-0215
Vulnerability Analysis
The vulnerability is classified under [CWE-352] Cross-Site Request Forgery. The shared xoo-framework administrative settings handler is reused across all three XootiX plugins, which is why a single coding flaw impacts multiple products. The save_settings function processes administrative configuration changes without verifying a WordPress nonce or other anti-CSRF token. Because the function accepts arbitrary option names and values, an attacker can target sensitive WordPress options such as users_can_register and default_role. Setting these values to allow registration and assign the administrator role produces a direct path to administrative account creation.
Root Cause
The root cause is missing CSRF protection in the save_settings handler in class-xoo-admin-settings.php. WordPress provides wp_verify_nonce() and check_admin_referer() to validate request origin, but these checks are absent. The handler also fails to restrict which option keys may be written, compounding the impact of the missing origin validation.
Attack Vector
Exploitation requires social engineering: an attacker hosts a malicious page or sends a crafted link to a logged-in WordPress administrator. When the administrator visits the page, the browser automatically submits a forged POST request to the vulnerable plugin endpoint using the administrator's authenticated session cookies. The request updates arbitrary site options, enabling open user registration with the default role set to administrator. The attacker then registers a new account and gains complete control. The vulnerable code paths can be reviewed in the WordPress Plugin Trac for easy-login-woocommerce, side-cart-woocommerce, and waitlist-woocommerce.
No verified public proof-of-concept code is available. See the Wordfence advisory for CVE-2022-0215 for additional technical details.
Detection Methods for CVE-2022-0215
Indicators of Compromise
- Unexpected new administrator accounts in wp_users and wp_usermeta tables, particularly accounts created shortly after a successful POST to the plugin settings endpoint.
- WordPress option changes to users_can_register set to 1 and default_role set to administrator without corresponding administrative intent.
- HTTP POST requests to xoo-framework admin settings endpoints carrying Referer headers from untrusted external domains.
Detection Strategies
- Review web server access logs for POST requests to plugin admin endpoints whose Referer originates outside the site's own domain.
- Audit WordPress options history and user creation events, correlating timestamps against plugin settings updates.
- Enable WordPress activity logging plugins to capture option changes and role assignments in real time.
Monitoring Recommendations
- Alert on any modification of users_can_register or default_role values in the wp_options table.
- Monitor for newly registered users that immediately receive the administrator role.
- Track installed plugin versions across WordPress fleets to identify hosts still running affected XootiX plugin versions.
How to Mitigate CVE-2022-0215
Immediate Actions Required
- Update Login/Signup Popup to a version above 2.2, Waitlist Woocommerce above 2.5.1, and Side Cart Woocommerce above 2.0.
- Audit all WordPress administrator accounts and remove any that were not provisioned by the site owner.
- Reset users_can_register to 0 and default_role to subscriber if the site does not require open registration.
- Force password rotation for all remaining administrator accounts and review API keys and application passwords.
Patch Information
XootiX released patched plugin versions following disclosure. Site operators should upgrade through the WordPress plugin update mechanism or by downloading current releases from the WordPress Plugin Directory. Consult the Wordfence vulnerability advisory for CVE-2022-0215 for version-specific guidance.
Workarounds
- Deactivate and remove the affected XootiX plugins until patched versions are deployed.
- Restrict access to /wp-admin/ by source IP using web server or WAF rules to reduce CSRF exposure for administrators.
- Deploy a web application firewall rule that blocks POST requests to plugin admin endpoints lacking a valid same-origin Referer header.
# Example WP-CLI commands to harden registration settings
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin update easy-login-woocommerce side-cart-woocommerce waitlist-woocommerce
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
