Pierluigi Paganini April 27, 2019

WordPress-based eCommerce websites using the WooCommerce plugin are at risk of full compromise due to an unpatched vulnerability.

A WordPress security firm called ‘Plugin Vulnerabilities’ has discovered a critical vulnerability in the WooCommerce plugin that exposes
WordPress-based eCommerce websites to hack.

The vulnerability affects the WooCommerce Checkout Manager plugin that allows owners of e-commerce websites based on WordPress and running the WooCommerce plugin to customize forms on their checkout pages.

The experts discovered an “arbitrary file upload” vulnerability that can be exploited by unauthenticated, remote attackers when the websites have “Categorize Uploaded Files” option enabled within WooCommerce Checkout Manager plugin settings.

Currently the plugin is used by more than 60,000 websites.

The company decided to publish the details of the flaw and a proof-of-concept exploit to protest against maintainers of the WordPress Support forum. It declared that over the years has tried to report the vulnerabilities directly to the WordPress Support forum without success because the moderators have been systematically removed their posts warning the community.

The company is focused on discovering vulnerabilities in popular and widely adopted WordPress plugins.

Analyzing the code, the experts discovered that at line 2084 of the
‘includes/admin.php’ file the application moves specific files to a directory using ‘move_uploaded_file’ without prior proper check for allowed files,”

The vulnerability could be exploited by attackers to execute arbitrary server-side script code in the context of the web server process and compromise the application to access or modify data or gain administrative access.

“If that is enabled then the following code will be used, which allows arbitrary files to be uploaded: ” wrote the experts.

“So a hacker could use that to upload malicious .php files at a location they could then access, as the proof of concept below shows.”

Below the proof-of-concept released by the experts:

Even the latest WooCommerce Checkout Manager version 4.2.6 is affected by the flaw.

To mitigate the flaw the experts suggest owners of WordPress websites using the WooCommerce Checkout Manager plugin to either disable “Categorize Uploaded Files” option or disable the plugin.

Pierluigi Paganini

(SecurityAffairs – WooCommerce, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]