CVE-2022-0215: Xootix Login/Signup Popup CSRF Vulnerability

CVE-2022-0215 Overview

CVE-2022-0215 is a Cross-Site Request Forgery (CSRF) vulnerability affecting three popular WordPress plugins developed by XootiX: Login/Signup Popup, Waitlist Woocommerce (Back in stock notifier), and Side Cart Woocommerce (Ajax). The vulnerability exists in the save_settings function located in the shared ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file. Due to missing nonce verification, attackers can trick authenticated administrators into executing malicious requests that update arbitrary WordPress options, potentially leading to complete site takeover.

Critical Impact

Successful exploitation allows attackers to modify any WordPress option, enabling creation of administrative user accounts and granting full privileged access to compromised sites.

Affected Products

• XootiX Login/Signup Popup versions <= 2.2
• XootiX Waitlist Woocommerce (Back in stock notifier) versions <= 2.5.1
• XootiX Side Cart Woocommerce (Ajax) versions <= 2.0

Discovery Timeline

• 2022-01-18 - CVE-2022-0215 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0215

Vulnerability Analysis

This CSRF vulnerability stems from the shared XootiX framework used across three WordPress plugins. The save_settings function in class-xoo-admin-settings.php processes administrative settings changes without proper CSRF token validation. When an authenticated administrator visits a maliciously crafted page while logged into their WordPress site, the attacker's page can submit requests to the vulnerable endpoint, bypassing WordPress's built-in CSRF protections.

The impact is particularly severe because the vulnerable function can update arbitrary WordPress options. An attacker could leverage this to register a new administrative user by modifying the users_can_register option and setting the default role to administrator, or directly inject malicious content into site settings. According to Wordfence's analysis, approximately 84,000 WordPress sites were affected by these three plugins sharing the same vulnerable codebase.

Root Cause

The root cause is the absence of nonce verification in the save_settings function. WordPress provides the wp_verify_nonce() and check_admin_referer() functions specifically to prevent CSRF attacks by validating that requests originate from legitimate administrative sessions. The vulnerable code processes POST requests and updates WordPress options without calling these security functions, allowing any request—including those forged by attackers—to be processed as legitimate.

Attack Vector

The attack requires social engineering to lure an authenticated WordPress administrator to a malicious website or click a crafted link. The attacker's page contains hidden form elements or JavaScript that automatically submits a POST request to the vulnerable save_settings endpoint. Because the administrator's browser automatically includes their WordPress session cookies, the malicious request is processed with full administrative privileges.

The attack flow typically involves:

1. Attacker identifies a WordPress site running a vulnerable XootiX plugin
2. Attacker crafts a malicious HTML page containing a hidden form targeting the victim site's admin-ajax.php endpoint
3. Attacker tricks the site administrator into visiting the malicious page
4. The form auto-submits, modifying critical WordPress options such as users_can_register and default_role
5. Attacker registers a new account with administrative privileges, gaining full control

Detection Methods for CVE-2022-0215

Indicators of Compromise

• Unexpected changes to WordPress options, particularly users_can_register, default_role, or administrative email settings
• Newly created administrator accounts that were not authorized by legitimate site owners
• Modified plugin settings without administrator action
• Suspicious entries in WordPress audit logs showing settings changes without corresponding admin interface activity

Detection Strategies

• Review WordPress user accounts regularly to identify unauthorized administrator accounts
• Monitor the wp_options table for unexpected changes to security-critical options
• Implement web application firewall (WAF) rules to detect and block CSRF attempts targeting XootiX plugin endpoints
• Enable comprehensive logging for WordPress administrative actions and plugin settings changes

Monitoring Recommendations

• Deploy SentinelOne Singularity to monitor WordPress application behavior and detect anomalous administrative operations
• Configure alerts for new user registration events, especially with elevated privileges
• Implement file integrity monitoring to detect unauthorized changes to plugin files
• Set up real-time notifications for modifications to WordPress core options

How to Mitigate CVE-2022-0215

Immediate Actions Required

• Update Login/Signup Popup to a version higher than 2.2
• Update Waitlist Woocommerce (Back in stock notifier) to a version higher than 2.5.1
• Update Side Cart Woocommerce (Ajax) to a version higher than 2.0
• Audit all administrator accounts and remove any unauthorized users
• Review and reset any modified WordPress options to their intended values

Patch Information

The vulnerability has been addressed in updated versions of all three affected plugins. The fixes implement proper nonce verification in the save_settings function using WordPress's built-in CSRF protection mechanisms. Site administrators should update to the latest available versions through the WordPress plugin repository. Technical details of the vulnerable code can be reviewed in the WordPress Plugin Trac for Login/Signup Popup, Side Cart Woocommerce, and Waitlist Woocommerce.

Workarounds

• Temporarily deactivate the affected plugins until patches can be applied
• Implement a web application firewall with CSRF protection rules
• Restrict administrative access to trusted IP addresses using .htaccess or security plugins
• Ensure administrators use separate browsers or browser profiles for WordPress administration and general web browsing

# WordPress CLI commands to audit and secure affected sites
# Check installed plugin versions
wp plugin list --fields=name,version | grep -E "(easy-login-woocommerce|side-cart-woocommerce|waitlist-woocommerce)"

# List all administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Check if user registration is unexpectedly enabled
wp option get users_can_register

# Check default user role setting
wp option get default_role