Pierluigi Paganini April 07, 2015

Million of WordPress websites are vulnerable to cyber attacks due to a critical vulnerability affecting the WP-Super-Cache plugin.

Million of WordPress websites using the WP-Super-Cache are exposed to the risk of cyber attack due to a critical vulnerability affecting the popular plugin. The WP-Super-Cache plugin, is normally used to improve the performance of the WordPress website because it generates static HTML files from dynamic WordPress blogs.

The critical persistent cross-site scripting vulnerability was reported by experts from Sucuri,  researcher Marc-Alexandre Montpas explained that attackers can exploit the flaw to inject malicious code into WordPress-published pages that use the extension.

According to Montpas administrators of WordPress websites who use the plug in urge to upgrade to the plugin to the version 1.4.4, which fixes the bug.

“Using this vulnerability, an attacker using a carefully crafted query could insert malicious scripts to the plugin’s cached file listing page. As this page requires a valid nonce in order to be displayed, a successful exploitation would require the site’s administrator to have a look at that particular section, manually.

When executed, the injected scripts could be used to perform a lot of other things like adding a new administrator account to the site, injecting backdoors by using WordPress theme edition tools, etc.” Sucuri researcher Marc-Alexandre Montpas wrote in blog post published on the company website.

The blog post highlights that the flaw lies in the way WP-Super-Cache displays information stored in the cache file key. The WP-Super-Cache file’s key is used by the popular plugin to select the proper cache file to load.

“As you can see from the above, the $details[ ‘key’ ] is directly appended to the page’s content, without being sanitized first ($details[ ‘uri’ ] is sanitized somewhere else, before this snippet).” continues the post.

“As the ‘key’ index of the $details variable contains the get_wp_cache_key() function’s return (which contains data coming straight from the user’s cookies), an attacker can insert malicious scripts on the page.”

The expert explained that in vulnerable versions, data was appended to the page contents without any validation mechanism, this means that an attacker can inject any kind of malicious commands.

Pierluigi Paganini

(Security Affairs –  WordPress, WP-Super-Cache)