What is the threat?
A serious vulnerability in WordPress was recently discovered via the specific plugin known as “Simple Social Buttons.” This add-on enables site editors to insert social media sharing buttons throughout their website in an appealing and accessible fashion. However, an exploit of the plugin can allow cyber-attackers, even as non-admin users, to modify WordPress installation options and ultimately take over the website.
Why is this noteworthy?
Multiple WordPress vulnerabilities may have already been reported on, but this specific one was only just recently discovered. A notable point about it is how easy it is for site visitors with potentially malicious intents to execute. Exploitation of this vulnerability is possible provided that a user can register for an account on the WordPress-Hosted website. It does not matter how low-privileged their account may be; if they can simply post a comment anywhere as a user, the cyber-attacker can still overtake the entire site or even an administrator’s account.
What is the exposure or risk?
Researchers with WebARX, a web developer-focused security platform, demonstrated a Proof of Concept (PoC) attack where they explicitly took advantage of the plugin’s “improper application design flow and lack of permission checks.” Accordingly, they were able to easily execute privilege-escalation, access the WordPress installation capabilities from the “wp_options table,” and prove how one with malicious intent could go so far as deleting an entire site or website defacement. With total control of one’s WordPress website or account, cyber-attackers may have access to all kinds of Personally Identifiable Information (PII) of the site administrators. Attacker can delete essential files, upload malware and infect all user of the website, also defacement which can affect the brand reputation of the company.
What are the recommendations?
Fortunately, there was a patch released promptly after the vulnerability was discovered. It does combat this exploit efficiently, but site admins still need to actively update the “Simple Social Buttons” plugin. It is also referred that WordPress users and site administrators be generally mindful of the add-ons that they may utilize.
References:
For more in-depth information about the recommendations, please visit the following link:
- https://threatpost.com/wordpress-plugin-flaw-website-takeover/141746/
- https://www.webarxsecurity.com/wordpress-plugin-simple-social-buttons/
If you have any questions, please contact our Secure Intelligence Center.