Monthly Archives: December 2024

Premium WPLMS WordPress plugins address seven critical flaws

Posted on

Two WordPress plugins required by the premium WordPress WPLMS theme, which has over 28,000 sales, are vulnerable to more than a dozen critical severity vulnerabilities.

The bugs could enable a remote, unauthenticated attacker to upload arbitrary files to the server, execute code, escalate privileges to administrator level, and perform SQL injections.

The WPLMS theme is a learning management system (LMS) for WordPress, used primarily by educational institutions, corporations providing training, and e-learning providers. It also offers integration with WooCommerce for selling courses.

Vulnerabilities in WPLMS theme

Patchstack vulnerability researchers found a total of 18 security issues in the WPLMS and VibeBP plugins and present in a recent report 10 of the most significant ones.

Here’s a summary of the flaws impacting the WPLMS theme:

  1. CVE-2024-56046 (CVSS 10.0): Allows attackers to upload malicious files without authentication, potentially leading to remote code execution (RCE).
  2. CVE-2024-56050 (CVSS 9.9): Authenticated users with subscriber privileges can upload files, bypassing restrictions.
  3. CVE-2024-56052 (CVSS 9.9): Similar to Subscriber+ but exploitable by users with student roles.
  4. CVE-2024-56043 (CVSS 9.8): Attackers can register as any role, including Administrator, without authentication.
  5. CVE-2024-56048 (CVSS 8.8): Low-privilege users can escalate to higher roles, such as Administrator, by exploiting weak role validation.
  6. CVE-2024-56042 (CVSS 9.3): Attackers can inject malicious SQL queries to extract sensitive data or compromise the database.
  7. CVE-2024-56047 (CVSS 8.5): Low-privilege users can execute SQL queries, potentially compromising data integrity or confidentiality.

And for VibeBP:

  1. CVE-2024-56040 (CVSS 9.8): Attackers can register as privileged users without authentication.
  2. CVE-2024-56039 (CVSS 9.3): SQL queries can be injected by unauthenticated users, exploiting poorly sanitized inputs.
  3. CVE-2024-56041 (CVSS 8.5): Authenticated users with minimal privileges can perform SQL injection to compromise or extract database information.

Users of WPLMS should upgrade to version 1.9.9.5.3 and newer, while VibeBP should be upgraded to 1.9.9.7.7 or later.

As a general security advice, Patchstack suggests that websites enforce secure file uploads, SQL query sanitation, and role-based access controls.

Patchstack found the vulnerabilities and on March 31 notified Vibe Themes, the developer of WPLMS, of the issues. Between April and November, the developer tested multiple patches until they were able to fix all the vulnerabilities.

Vibe Themes collaborated with Patchstack to make sure that the delivered fix addresses all the bugs.

Source: https://www.bleepingcomputer.com/news/security/premium-wplms-wordpress-plugins-address-seven-critical-flaws/

390,000 WordPress accounts stolen from hackers in supply chain attack

Posted on

A threat actor tracked as MUT-1244 has stolen over 390,000 WordPress credentials in a large-scale, year-long campaign targeting other threat actors using a trojanized WordPress credentials checker.

Researchers at Datadog Security Labs, who spotted the attacks, say that SSH private keys and AWS access keys were also stolen from the compromised systems of hundreds of other victims, believed to include red teamers, penetration testers, security researchers, as well as malicious actors.

The victims were infected using the same second-stage payload pushed via dozens of trojanized GitHub repositories delivering malicious proof-of-concept (PoC) exploits that targeted known security flaws, along with a phishing campaign prompting targets to install a fake kernel upgrade camouflaged as a CPU microcode update.

While the phishing emails tricked victims into executing commands that installed the malware, the fake repositories duped security professionals and threat actors seeking exploit code for specific vulnerabilities.

Threat actors have used fake proof-of-concept exploits in the past to target researchers, hoping to steal valuable research or gain access to the networks of cybersecurity firms.

“Due to their naming, several of these repositories are automatically included in legitimate sources, such as Feedly Threat Intelligence or Vulnmon, as proof-of-concept repositories for these vulnerabilities,” the researchers said.” This increases their look of legitimacy and the likelihood that someone will run them.”

The payloads were dropped via GitHub repos using multiple methods, including backdoored configure compilation files, malicious PDF files, Python droppers, and malicious npm packages included in the projects’ dependencies.

As Datadog Security Labs found, this campaign overlaps with one highlighted in a November Checkmarkx report about a year-long supply-chain attack in which the “hpc20235/yawp” GitHub project was trojanized using malicious code in the “0xengine/xmlrpc” npm package to steal data and mine Monero cryptocurrency.

Malware deployed in these attacks includes a cryptocurrency miner and a backdoor that helped MUT-1244 collect and exfiltrate private SSH keys, AWS credentials, environment variables, and key directory contents such as “~/.aws.” 

The second-stage payload, hosted on a separate platform, allowed the attackers to exfiltrate data to file-sharing services like Dropbox and file.io, with the investigators finding hardcoded credentials for these platforms within the payload, giving the attackers easy access to the stolen info.

“MUT-1244 was able to gain access to over 390,000 credentials, believed to be WordPress ones. We assess with high confidence that before these credentials were exfiltrated to Dropbox, they were in the hands of offensive actors, who likely acquired them through illicit means,” Datadog Security Labs researchers said.

“These actors were then compromised through the yawpp tool they used to check the validity of these credentials. Since MUT-1244 advertised yawpp as a “credentials checker” for WordPress, it’s no surprise that an attacker with a set of stolen credentials (which are often purchased from underground markets as a way to speed up threat actor operations) would use yawpp to validate them.”

The attackers successfully exploited trust within the cybersecurity community to compromise dozens of machines belonging to both white hat and black hat hackers after the targets unknowingly executed the threat actor’s malware, leading to data theft that included SSH keys, AWS access tokens, and command histories.

Datadog Security Labs estimates that hundreds of systems remain compromised, and others are still getting infected as part of this ongoing campaign.

Source: https://www.bleepingcomputer.com/news/security/390-000-wordpress-accounts-stolen-from-hackers-in-supply-chain-attack/

Critical WordPress plugin vulnerability under active exploit threatens thousands

Posted on

Vulnerability with severity rating of 9.8 out of possible 10 still live on >8,000 sites

Thousands of sites running WordPress remain unpatched against a critical security flaw in a widely used plugin that was being actively exploited in attacks that allow for unauthenticated execution of malicious code, security researchers said.

The vulnerability, tracked as CVE-2024-11972, is found in Hunk Companion, a plugin that runs on 10,000 sites that use the WordPress content management system. The vulnerability, which carries a severity rating of 9.8 out of a possible 10, was patched earlier this week. At the time this post went live on Ars, figures provided on the Hunk Companion page indicated that less than 12 percent of users had installed the patch, meaning nearly 9,000 sites could be next to be targeted.

Significant, multifaceted threat

“This vulnerability represents a significant and multifaceted threat, targeting sites that use both a ThemeHunk theme and the Hunk Companion plugin,” Daniel Rodriguez, a researcher with WordPress security firm WP Scan, wrote. “With over 10,000 active installations, this exposed thousands of websites to anonymous, unauthenticated attacks capable of severely compromising their integrity.”

Rodriquez said WP Scan discovered the vulnerability while analyzing the compromise of a customer’s site. The firm found that the initial vector was CVE-2024-11972. The exploit allowed the hackers behind the attack to cause vulnerable sites to automatically navigate to wordpress.org and download WP Query Console, a plugin that hasn’t been updated in years.

The attackers then exploited a vulnerability in the latter plugin that allowed them to execute malicious code. The WP Query Console vulnerability, tracked as CVE-2024-50498, carries a severity score of 10 and remains unpatched.

The WP Query Scan page on wordpress.org says that the plugin was made temporarily unavailable as of October pending review. The hackers behind the attacks were able to get their exploit to download the years-old WP Query Console plugin anyway, because they used a special wordpress.org URL that overrode the block. Rodriguez said the vulnerability stemmed from a flaw in Hunk Companion code that allowed “unauthenticated requests to bypass the intended checks” that led to the “installation and activation of arbitrary plugins.”

The Hunk Companion vulnerability has been patched in version 1.9.0, which was released two days ago. Hunk Companion developers patched a similar vulnerability with the release of version 1.8.5. The earlier vulnerability was tracked as CVE-2024-9707 and also had a severity rating of 9.8.

As noted earlier, the page for that plugin indicated that only 11.9 percent of sites using the plugin had installed the update. It’s not clear if the special wordpress.org URL still permits the downloading of plugins that have otherwise been blocked. If so, any unpatched sites remain vulnerable to the same exploits.

WordPress.org representatives didn’t immediately respond to an email asking why the override mechanism had been available previously or if it remained available now.

Source: https://arstechnica.com/security/2024/12/thousands-of-sites-remain-unpatched-against-actively-exploited-wordpress-plugin-bug/

See also: https://www.bleepingcomputer.com/news/security/hunk-companion-wordpress-plugin-exploited-to-install-vulnerable-plugins/

6,000,000 WordPress Sites Protected Against Payment Refund and Subscription Cancellation Vulnerability in WPForms WordPress Plugin

Posted on

On October 23th, 2024, Wordfence received a submission for a Missing Authorization to Payment Refund and Subscription Cancellation vulnerability in WPForms, a WordPress plugin with more than 6,000,000 active installations. This vulnerability makes it possible for an authenticated attacker, with subscriber-level access and above, to refund Stripe payments and cancel Stripe subscriptions.

Props to villu164 who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $2,376.00 for this discovery.

We’d also like to say a special congratulations to villu164, who became the first researcher to earn the WordPress Superhero badge through the Wordfence Bug Bounty Program!

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on November 15, 2024. Sites using the free version of Wordfence will receive the same protection 30 days later on December 15, 2024.

Wordfence sent the full disclosure details to the Awesome Motive team on November 14, 2024, and received a response on the next day. The developer released a patch on November 18, 2024. We would like to commend the Awesome Motive team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of WPForms, version 1.9.2.2 at the time of this writing, as soon as possible.

Source: https://www.wordfence.com/blog/2024/12/6000000-wordpress-sites-protected-against-payment-refund-and-subscription-cancellation-vulnerability-in-wpforms-wordpress-plugin

WPForms bug allows Stripe refunds on millions of WordPress sites

Posted on

A vulnerability in WPForms, a WordPress plugin used in over 6 million websites, could allow subscriber-level users to issue arbitrary Stripe refunds or cancel subscriptions.

Tracked under CVE-2024-11205, the flaw was categorized as a high-severity problem due to the authentication prerequisite. However, given that membership systems are available on most sites, exploitation may be fairly easy in most cases.

The issue impacts WPForms from version 1.8.4 and up to 1.9.2.1, with a patch pushed in version 1.9.2.2, released last month.

WPForms is an easy-to-use drag-and-drop WordPress form builder for creating contact, feedback, subscription, and payment forms, offering support for Stripe, PayPal, Square, and others.

The plugin is available in both a premium (WPForms Pro) version and a free (WPForms Lite) edition. The latter is active on over six million WordPress sites.

The vulnerability stems from improperly using the function ‘wpforms_is_admin_ajax()’ to determine if a request is an admin AJAX call.

While this function checks if the request originates from an admin path, it does not enforce capability checks to restrict access based on the user’s role or permissions.

This allows any authenticated user, even subscribers, to invoke sensitive AJAX functions like ‘ajax_single_payment_refund(),’ which executes Stripe refunds, and ‘ajax_single_payment_cancel(),’ which cancels subscriptions.

The consequences of CVE-2024-11205 exploitation could be severe for website owners, leading to loss of revenue, business disruption, and trust issues with their customer base.

Fix available

The flaw was discovered by security researcher ‘vullu164,’ who reported it to Wordfence‘s bug bounty program for a payout of $2,376 on November 8, 2024.

Wordfence subsequently validated the report and confirmed the provided exploit, sending the full details to the vendor, Awesome Motive, on November 14.

By November 18, Awesome Motive released the fixed version 1.9.2.2, adding proper capability checks and authorization mechanisms in the affected AJAX functions.

According to wordpress.org stats, roughly half of all sites using WPForms aren’t even on the latest release branch (1.9.x), so the number of vulnerable websites is at least 3 million.

Wordfence has not detected active exploitation of CVE-2024-11205 in the wild yet, but upgrading to version 1.9.2.2 as soon as possible or disabling the plugin from your site is recommended.

Source: https://www.bleepingcomputer.com/news/security/wpforms-bug-allows-stripe-refunds-on-millions-of-wordpress-sites/

800,000 people had their full names, SSNs, and more exposed in massive insurance admin company data breach

Posted on

How to see if your data was exposed and what to do next

Staying safe from hackers is hard enough as it is but even if you take all the necessary precautions, your personal data could still end up being exposed online as the result of a data breach and that’s exactly what just happened to more than 800,000 people.

As reported by BleepingComputer, the insurance administrative services company Landmark Admin has revealed that it suffered a data breach following a cyberattack that occurred back in May of this year. While you likely haven’t heard of this company before, there’s a chance it could have access to your sensitive personal information.

Landmark Admin is a third-party administrator for a number of insurance companies and it provides back-office services for them such as new business processing and claims administration. In fact, some of the insurance companies it works with include American Monumental Life Insurance Company, Pellerin Life Insurance Company, American Benefit Life Insurance Company, Liberty Bankers Life Insurance Company, Continental Mutual Insurance Company and the Capitol Life Insurance Company.

If any of the companies listed above happen to be your insurance company, then there’s a chance you may receive a data breach notification letter in the mail, if you haven’t already. Here’s everything you need to know about this latest data breach and what steps you should take next if your personal data was exposed online.

Source: https://www.tomsguide.com/computing/online-security/800-000-people-just-had-their-full-names-ssns-and-more-exposed-in-a-massive-insurance-admin-company-data-breach