A WordPress security firm called ‘Plugin Vulnerabilities’ has discovered a critical vulnerability in the WooCommerce plugin that exposes
WordPress-based eCommerce websites to hack.
The vulnerability affects the WooCommerce Checkout Manager plugin that allows owners of e-commerce websites based on WordPress and running the WooCommerce plugin to customize forms on their checkout pages.
The experts discovered an “arbitrary file upload” vulnerability that can be exploited by unauthenticated, remote attackers when the websites have “Categorize Uploaded Files” option enabled within WooCommerce Checkout Manager plugin settings.
Currently the plugin is used by more than 60,000 websites.
The company decided to publish the details of the flaw and a proof-of-concept exploit to protest against maintainers of the WordPress Support forum. It declared that over the years has tried to report the vulnerabilities directly to the WordPress Support forum without success because the moderators have been systematically removed their posts warning the community.
The company is focused on discovering vulnerabilities in popular and widely adopted WordPress plugins.
Analyzing the code, the experts discovered that at line 2084 of the
‘includes/admin.php’ file the application moves specific files to a directory using ‘move_uploaded_file’ without prior proper check for allowed files,”
The vulnerability could be exploited by attackers to execute arbitrary server-side script code in the context of the web server process and compromise the application to access or modify data or gain administrative access.
“If that is
“So a hacker could use that to upload malicious .php files at a location they could then access, as the proof of concept below shows.”
Below the proof-of-concept released by the experts:
Even the latest WooCommerce Checkout Manager version 4.2.6 is affected by the flaw.
To mitigate the flaw the experts suggest owners of WordPress websites using the WooCommerce Checkout Manager plugin to either disable “Categorize Uploaded Files” option or disable the plugin.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.