WordPress-based eCommerce websites using the WooCommerce plugin are at risk of full compromise due to an unpatched vulnerability.
A WordPress security firm called ‘Plugin Vulnerabilities’ has discovered a critical vulnerability in the WooCommerce plugin that exposes WordPress-based eCommerce websites to hack.
The vulnerability affects the WooCommerce Checkout Manager plugin that allows owners of e-commerce websites based on WordPress and running the WooCommerce plugin to customize forms on their checkout pages.
The experts discovered an “arbitrary file upload” vulnerability that can be exploited by unauthenticated, remote attackers when the websites have “Categorize Uploaded Files” option enabled within WooCommerce Checkout Manager plugin settings.
Currently the plugin is used by more than 60,000 websites.
The company decided to publish the details of the flaw and a proof-of-concept exploit to protest against maintainers of the WordPress Support forum. It declared that over the years has tried to report the vulnerabilities directly to the WordPress Support forum without success because the moderators have been systematically removed their posts warning the community.
The company is focused on discovering vulnerabilities in popular and widely adopted WordPress plugins.
Analyzing the code, the experts discovered that at line 2084 of the ‘includes/admin.php’ file the application moves specific files to a directory using ‘move_uploaded_file’ without prior proper check for allowed files,”
The vulnerability could be exploited by attackers to execute arbitrary server-side script code in the context of the web server process and compromise the application to access or modify data or gain administrative access.
“If that is enabled then the following code will be used, which allows arbitrary files to be uploaded: ” wrote the experts.
“So a hacker could use that to upload malicious .php files at a location they could then access, as the proof of concept below shows.”
Below the proof-of-concept released by the experts:
Even the latest WooCommerce Checkout Manager version 4.2.6 is affected by the flaw.
To mitigate the flaw the experts suggest owners of WordPress websites using the WooCommerce Checkout Manager plugin to either disable “Categorize Uploaded Files” option or disable the plugin.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.