Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-10470 | Unauthenticated File Read/Deletion Leading to RCE in WPLMS WordPress Theme CVE-2024-10470 is a path traversal flaw (CWE-22) in the WPLMS Learning Management System theme for WordPress by vibethemes, where the readfile and unlink functions lack sufficient file path validation and permission checks. An unauthenticated attacker can send network requests that reach these functions to read arbitrary files on the server and, more critically, delete arbitrary files. Deleting the right file, such as wp-config.php, can easily lead to remote code execution, while file reads can expose sensitive server contents. All versions up to and including 4.962 are affected, and the theme remains vulnerable even when it is installed but not activated, so exposure extends beyond actively used installations. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 34.4% probability of exploitation within 30 days (98th percentile), making this a high-priority patch. Do: Update WPLMS to a patched version newer than 4.962 as soon as one is available. Audit every WordPress installation that has the theme installed, including sites where the theme is inactive, and remove or update unused copies. Until patched, monitor logs for unauthenticated requests triggering file read/delete operations and watch for unexpected deletions of critical files such as wp-config.php. | 9.8 | 34% |
| large≈ tens of thousands of WordPress sites | ||
| CVE-2024-10924 | Unauthenticated Authentication Bypass in Really Simple Security WordPress Plugin CVE-2024-10924 is a critical (CVSS 9.8) unauthenticated authentication bypass in the Really Simple Security plugin for WordPress (Free, Pro, and Pro Multisite editions), affecting versions 9.0.0 through 9.1.1.1. It stems from improper user check error handling in the 'check_login_and_get_user' function used by the two-factor REST API actions, and can be triggered when the plugin's 'Two-Factor Authentication' setting is enabled (it is disabled by default). An unauthenticated attacker can exploit it to log in as any existing user on the site, including an administrator, gaining full control of the affected WordPress site. Any WordPress site running one of the affected plugin versions with two-factor authentication turned on is exposed, and public reporting indicates the plugin is installed on more than 4 million sites. As of the latest data there is no confirmed in-the-wild exploitation, no public proof-of-concept, and it is not in CISA's KEV catalog, but EPSS assigns an 82% probability of exploitation within the next 30 days (99th+ percentile), so rapid patching is warranted. Do: Update the Really Simple Security plugin to a fixed release (any version after 9.1.1.1) on all Free, Pro, and Pro Multisite installations. As an interim mitigation, disable the 'Two-Factor Authentication' setting or restrict access to the WordPress REST API until patched. After updating, review recent authentication logs and administrator accounts for signs of unauthorized logins. | 9.8 | 82% |
| mass≈4,000,000+ WordPress sites install the plugin, though only the subset with Two-Factor Authentication enabled is directly exploitable |
Full article397 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 18, 2024Vulnerability / Website Security
A critical authentication bypass vulnerability has been disclosed in the Really Simple Security (formerly Really Simple SSL) plugin for WordPress that, if successfully exploited, could grant an attacker to remotely gain full administrative access to a susceptible site.
The vulnerability, tracked as CVE-2024-10924 (CVSS score: 9.8), impacts both free and premium versions of the plugin. The software is installed on over 4 million WordPress sites.
"The vulnerability is scriptable, meaning that it can be turned into a large-scale automated attack, targeting WordPress websites," Wordfence security researcher István Márton said.
Following responsible disclosure on November 6, 2024, the shortcoming has been patched in version 9.1.2 released a week later. This risk of possible abuse has prompted the plugin maintainers to work with WordPress to force-update all sites running this plugin prior to public disclosure.
According to Wordfence, the authentication bypass vulnerability, found in versions 9.0.0 to 9.1.1.1, arises from improper user check error handling in a function called "check_login_and_get_user," thereby allowing unauthenticated attackers to login as arbitrary users, including administrators, when two-factor authentication is enabled.
"Unfortunately, one of the features adding two-factor authentication was insecurely implemented making it possible for unauthenticated attackers to gain access to any user account, including an administrator account, with a simple request when two-factor authentication is enabled," Márton said.
Successful exploitation of the vulnerability could have serious consequences, as it could permit malicious actors to hijack WordPress sites and further use them for criminal purposes.
The disclosure comes days after Wordfence revealed another critical shortcoming in the WPLMS Learning Management System for WordPress, WordPress LMS (CVE-2024-10470, CVSS score: 9.8) that could enable unauthenticated threat actors to read and delete arbitrary files, potentially resulting in code execution.
Specifically, the theme, prior to version 4.963, is "vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks," allowing unauthenticated attackers to delete arbitrary files on the server.
"This makes it possible for unauthenticated attackers to read and delete any arbitrary file on the server, including the site’s wp-config.php file," it said. "Deleting wp-config.php forces the site into a setup state, allowing an attacker to initiate a site takeover by connecting it to a database under their control."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/11/urgent-critical-wordpress-plugin.html