A WordPress plugin with a vulnerability threatened the integrity of thousands of websites. The vulnerability existed in the Popup Builder plugin that risked over 100,000 WordPress websites.
Popup Builder Plugin Vulnerability
Team Wordfence, the researchers who have caught multiple security flaws in various WordPress plugins, have found another vulnerable plugin. This time, the vulnerability appeared in the Popup Builder WordPress plugin.
As elaborated in their blog post, an unauthenticated stored cross-site scripting (XSS) existed in the plugin. Regarding the flaw, the researchers stated,
It registered an AJAX hook,
wp_ajax_nopriv_sgpb_autosave, intended to allow auto-saving of draft popups.
Unfortunately, this hook was available to unprivileged users, and the function it called lacked nonce checks or capability checks.
Any logged-in user could easily exploit the bug by sending a malicious POST request and inserting a malicious JavaScript payload to the plugin settings. The payload would then execute every time a user visited a page that displayed a popup.
In this way, an attacker could exploit the vulnerability to execute various malicious activities. According to the researchers,
Typically, attackers use a vulnerability like this to redirect site visitors to malvertising sites or steal sensitive information from their browsers, though it could also be used for site takeover if an administrator visited or previewed a page containing the infected popup while logged in.
They went to say there also are numerous other vulnerabilities that could allow users with minimal permissions to gain access to subscriber details.
Patches Rolled Out
Upon finding the vulnerabilities, the researchers quickly reached out to the plugin developers to report the flaw.
Fortunately, the developers quickly responded to the researchers and worked out a fix for the flaw. Consequently, the bug that affected all the then available plugin versions received a fix with the release of Popup Builder plugin v.3.64.1.
Presently, the plugin boasts over 100,000 active installations. It means that the vulnerability also posed a threat to thousands of websites. Now that a fix is out, users must ensure updating their sites to the latest plugin version to avoid exploitation.
Let us know your thoughts in the comments.