We take a lot of precautions when it comes to the safety and security of your website but once we hand off your website to you that burden falls on you to maintain that. Nicely Done Sites offers a maintenance agreement so that we can continue to maintain your website so that it remains as safe and secure as possible. We highly recommend all of our clients purchase one but it is not mandatory. If not we hope at least that you do keep your WordPress website up to date and in this series of posts we are going to detail some of the vulnerabilities discovered or publicized this past month.
Given that February is the shortest month of the calendar year it should be no surprise that there were fewer vulnerabilities patched and disclosed this month than with other months. The major update of the month was the release of WordPress 5.1. Following the release of WordPress 5.0 in December it took about a week for several core vulnerabilities to be disclosed so there may be some included in March’s post.
NextGen Gallery
This plugin is one of the most popular for use with WordPress with over 1 million downloads. The vulnerability allowed for user input to be unserialized which could have allowed an unauthorized user to gain access to it. It was reported about a month ago and made public early in February when it was fixed.
Forminator
Multiple vulnerabilities here with an XSS and a blind SQL injection. Custom fields of polls were not being properly encoded which allowed an attacker to execute a JavaScript command and bypass CSRF protections. They would be able to perform legitimate operations and read any information that the user could access or even add admin users. This issue was reported in late November and fixed in early February.
Parallax Scroll
This was an XSS vulnerability that exploited unsanitized code. It was discovered in late January and fixed in early February.
Simple Social Buttons
This plugin makes it easy to add social media sharing buttons on a webpage and it is one of WordPress’ more popular ones with half a million downloads and 40,000 active installations making it a large target for botnet attacks due to this vulnerability. An Authenticated Object Injection was discovered that allowed a non-admin user or subscriber to modify installation options since a permission check was not incorporated into the design. All an attacker would need to do would be to register on the site and they could install a backdoor or take over administrative accounts. This vulnerability was fixed a day after its discovery.
WP Cost Estimation & Payment Forms
Two major vulnerabilities were found in outdated versions of this plugin. The first vulnerability was an Arbitrary File Upload and Delete vulnerability which allowed an attacker to upload a file and potentially gain access through the submission form. The only security check came in the form of a filename check which is not an effective way at combating upload security issues. This attack could allow an attacker to delete the site’s config file. When that file is deleted WordPress assumes that a fresh installation is taking place and the attacker can add their own database log and gain administrative access. This vulnerability was detected several months ago and patched quickly, but was not announced until this month.
The other vulnerability was an Upload Directory Traversal vulnerability. The previous patch solved the above issues and increased security but a bypass was still available. When files would be uploaded by a user they would need to be grouped in the same directory to keep things easy to understand. It was possible to manipulate the submission form to direct a file to the site’s root directory and could potentially allow files to be overwritten allowing an attacker to rewrite a site’s root directory. The good news is that this vulnerability was not as serious as a hidden field that gives each upload a unique number would either prevent files from being sent to any directory at all or from being able to delete files already in place. This vulnerability was identified at the end of January, was patched January 31 and was announced at the same time as the first issue.
WooCommerce
An update to the WooCommerce plugin fixed several security issues in WordPress’ #1 ecommerce plugin. Both of the issues, one with photoswipe captions and another involving JSON attributed that created an XSS vulnerability. Inadequate filtering on the image’s caption allowed users with contributor or higher access to insert scripts by changing the captions or uploading an image file. The issue was discovered in mid-February, fixed on February 18 and reported on February 20.
WordPress 5.1 was released on February 22 so make sure that your installation is updated!
One core vulnerability was disclosed in February. An Authenticated Code Execution allowed an attacker who had author privileges to execute arbitrary code by uploading an image with PHP code in the metadata. This can lead to a complete takeover of the site. This vulnerability existed for 6 years before it was discovered. Both the updates to WordPress 4.9.9 and 5.0.1 removed the potential exploit but a Path Traversal vulnerability still exists if certain plugins that allow the overwriting of arbitrary post data were installed. A patch has been developed by WordPress though it is unlikely that this vulnerability can be exploited following the past updates. It is also unclear if the patch was included in WordPress 5.1.
Newspaper Theme
The Newspaper Theme is the #1 selling theme available for WordPress. It works well for blog sites, for news sites and incorporates video services like YouTube in easily. In the theme an XSS vulnerability was discovered and fixed as part of the most recent update on February 6.
