Experts warn of attacks exploiting WordPress gift card plugin

Threat actors are actively exploiting a critical flaw in the YITH WooCommerce Gift Cards Premium WordPress plugin installed by over 50,000 websites.

Hackers are actively exploiting a critical vulnerability, tracked as CVE-2022-45359 (CVSS v3: 9.8), affecting the WordPress plugin YITH WooCommerce Gift Cards Premium.

The YITH WooCommerce Gift Cards Premium plugin allows websites of online stores to sell gift cards, a WordPress plugin used on over 50,000 websites.

The CVE-2022-45359 flaw is an Arbitrary File Upload issue that can allow an unauthenticated attacker to upload files to vulnerable sites, including web shells that provide full access to the site.

The issue was discovered on November 22, 2022, and was addressed with the release of version 3.20.0.

Due to the presence of a lot of websites that are still using vulnerable versions of the plugin, threat actors are exploring the flaw in attacks in the wild to upload backdoors on the e-stores.

“The Wordfence Threat Intelligence team has been tracking exploits targeting a Critical Severity Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards Premium, a plugin with over 50,000 installations according to the vendor.” reported Wordfence. “This allows attackers to place a back door, obtain Remote Code Execution, and take over the site.”

The researchers were able to reverse engineer the exploit and discovered that the issue lies in the import_actions_from_settings_panel function which runs on the admin_init hook.

The hook runs for any page in the /wp-admin/ directory and allows to trigger functions that run on it as an unauthenticated attacker by sending a request to /wp-admin/admin-post.php.

The experts noticed that the import_actions_from_settings_panel function also lacks a capability check and a CSRF check. An unauthenticated attacker can send POST requests to “/wp-admin/admin-post.php” using the certain parameters to upload a malicious PHP executable on the site.

“Since the import_actions_from_settings_panel function also lacks a capability check and a CSRF check, it is trivial for an attacker to simply send a request containing a page parameter set to yith_woocommerce_gift_cards_panel, a ywgc_safe_submit_field parameter set to importing_gift_cards, and a payload in the file_import_csv file parameter.” continues the report. “Since the function also does not perform any file type checks, any file type including executable PHP files can be uploaded.”

The experts added that it is possible to discover the attacks by analyzing the logs and checking unexpected POST requests to wp-admin/admin-post.php from unknown IP addresses.

Below are some files uploaded by threat actors in attacks analyzed by Wordfence:

kon.php/1tes.php – this file loads a copy of the “marijuana shell” file manager in memory from a remote location (shell[.]prinsh[.]com)
b.php – this file is a simple uploader
admin.php – this file is a password-protected backdoor

Most of the attacks observed by Wordfence originated from 103.138.108.15 (19604 attacks against 10936 different sites) and 188.66.0.135 IP addresses (1220 attacks against 928 sites).

“The majority of attacks occurred the day after the vulnerability was disclosed, but have been ongoing, with another peak on December 14, 2022. As this vulnerability is trivial to exploit and provides full access to a vulnerable website we expect attacks to continue well into the future.” concludes the report.“

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, WordPress plugin)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.