CVE request / Advisory: Slideshow (Wordpress plugin) - Wordpress option value disclosure

[Matthew Daley <mattd () bugfuzz com>]

I'd like to request a CVE ID for this issue. This is the first such
request; this message serves as an advisory as well.

Affected software: Slideshow (Wordpress plugin)
Affected versions: 2.2.8 - 2.2.21
Website: https://wordpress.org/plugins/slideshow-jquery-image-gallery/
Reported by: Matthew Daley

Description:

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function,
accessible by unauthenticated users as an AJAX action, can be abused
to force the disclosure of arbitrary Wordpress option values.

The function is intended to return the content of a user-specified
slideshow stylesheet, whether it be an administrator-created custom
one or a default one included with the plugin. Custom stylesheets are
stored as Wordpress option values, so the function first looks for an
option matching the user-specified stylesheet name. If a matching
option is found, its value is returned as the stylesheet content.

However, the function does not validate the user-specified stylesheet
name before this option lookup is performed (apart from sanitizing
certain characters using the filter_input function). Hence, it is
possible to specify any option name in place of an actual custom
stylesheet name, regardless of whether the option is for the Slideshow
plugin, another plugin, a theme, or Wordpress itself. Doing so will
cause the function to retrieve the value of the user-specified option
and output it to the user.

Fixed version: 2.2.22
Fix: https://github.com/Boonstra/Slideshow/commit/cac505e593cbe70a4d8af5b639f5385d4cc7aa04
Changelog: https://wordpress.org/plugins/slideshow-jquery-image-gallery/changelog/

- Matthew Daley