Latest WordPress Plugin Zero-Day Vulnerabilities Exploits
By Kenneth Sprague | October 3rd, 2017
The team over at Wordfence, a software engineering company dedicated to WordPress Security and protecting your intellectual property, has identified 3 zero-day plugin vulnerabilities. Their security analysts tracked down the method the attacker used to compromise the site while conducting their site cleaning service. The exploits were elusive: a malicious file seemed to appear out of nowhere, and even sites with access logs only showed a POST request to /wp-admin/admin-ajax.php at the time the file was created. Analysts captured the attacks in their threat data, and the lead developer Matt Barry was able to reconstruct the exploits. They quickly pushed new WAF rules to block these exploits. Premium customers received the new rules and were protected immediately. Wordfence also notified the plugin authors; all three have published updates to fix the vulnerabilities.
PHP Object Injection Vulnerability Severity 9.8 (Critical) in Appointments, RegistrationMagic-Custom Registration Forms, and Flickr Gallery
Affected Plugins & Versions:
Appointments by WPMU Dev (fixed in 2.2.2)
Flickr Gallery by Dan Coulter (fixed in 1.5.3)
RegistrationMagic-Custom Registration Forms by CMSHelpLive (fixed in 126.96.36.199)
This vulnerability allowed attackers to cause a vulnerable website to fetch a remote file (a PHP backdoor) and save it to a location of their choice. It required no authentication or elevated privileges. For sites running Flickr Gallery, the attackers only had to send the exploit as POST request to the site’s root URL. For the other two plugins, the request would go to admin-ajax.php. If the attacker was able to access their backdoor, they could completely take over the vulnerable site.
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What To Do
If you are running the Premium version of Wordfence and have the firewall enabled, the new firewall rules are already protecting you. Free users of Wordfence and paid users who have the Wordfence firewall disabled and are running these plugins should update to the most recent versions immediately.