Possibly harmful vulnerabilities were discovered on a WordPress plugin that could affect more than 90,000 websites, security firm Wordfence revealed.
Wordfence's Threat Intelligence team spotted the problem last August, but while a bug fix was released, several installations of the WordPress plugin might not have been patched. Once hackers exploit this WordPress security risk, they could make a "complete site takeover" and place malicious code to uploaded posts.
WordPress Security Risk: Vulnerabilities Allow Users to Modify Pages, Posts
These vulnerabilities could allow users to become super admins, permitting them to modify pages and posts, even if they have already been published, TechCentral posted. Wordfence said it found out about the vulnerability as they made a routine firewall check last July. The company said the Brizy Page Builder "did not appear" to be under attack, but its researchers were led to believe something was wrong with the "unusual traffic."
The Brizy Page Building plugin utilized functions that would allow unauthorized administrative access, with users passing authorization checks as an administrator, thus bypassing other capability tests in the plugin. Due to what Wordfence describes as a "logic flaw," being logged in and reaching any endpoint in the wp-admin directory was enough to pass this check.
This flaw would allow users or subscribers to modify any page or post created and edited by the Brizy editor, even if it had been published.
Such odd site behavior led researchers to "discover two new vulnerabilities," including one that had been previously patched in the plugin "that had been reintroduced," Wordfence said in a blog post. These vulnerabilities could allow hackers to make a complete site takeover, Wordfence added.
Exploiting this vulnerability as a subscriber would still necessitate the submission of a request that contains valid "hash" and "editor-version" parameters, but these are mirrored on dashboard pages subscribers can access. The sole parameter a hacker would need to guess when altering a page is the "dataVersion" parameter, which consists of an incrementing integer starting at 1, that is easily deduced in a few moments after recurrent requests.
In addition, it is also possible for subscribers to upload executable files to a site location of their choice using the AJAX action, "brizly_create_block_screenshot."
The patched version of the Brizy Page Builder plugin has been released in August, just a few days after Wordfence discovered the vulnerability. The company "strongly recommends" that site owners immediately update to the latest 2.3.17 version of the plugin.