Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin

[Summer of Pwnage <lists () securify nl>]

------------------------------------------------------------------------
Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0021

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
It was discovered that the ALO EasyMail Newsletter WordPress Plugin is
vulnerable to Cross-Site Request Forgery. Amongst others, this issue can
be used to add/import arbitrary subscribers. In order to exploit this
issue, the attacker has to lure/force a victim into opening a malicious
website/link.

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on ALO EasyMail Newsletter WordPress
Plugin version 2.9.2.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in ALO EasyMail Newsletter version 2.9.3.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_alo_easymail_newsletter_wordpress_plugin.html

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.