CIS Logo
tagline: Confidence in the Connected World

A Vulnerability in WordPress Easy WP SMTP Plugin Could Allow for Remote Code Execution

MS-ISAC ADVISORY NUMBER:

2019-033

DATE(S) ISSUED:

03/25/2019

OVERVIEW:

A vulnerability has been discovered in the WordPress Easy WP SMTP Plugin that could allow for remote code execution. WordPress is a web-based publishing application implemented in PHP, and the Easy WP SMTP Plugin allows website administrators to configure an SMTP server for outgoing emails. Successful exploitation of this vulnerability could allow for remote code execution with elevated privileges.

THREAT INTELLIGENCE:

A Proof-of-Concept has been developed by the researchers who discovered this vulnerability. There are reports of this vulnerability being actively exploited in the wild in March 2019.

SYSTEMS AFFECTED:

  • WordPress Easy WP SMTP Plugin 1.3.9 and potentially prior

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in the WordPress Easy WP SMTP Plugin that could allow for remote code execution. This vulnerability exists because the plugin fails to properly authenticate users accessing the admin_init() function in the easy-wp-smtp.php file. An unauthenticated attacker can exploit this issue by crafting an AJAX request to publicly accessible pages that make use of the code including admin-ajax.php and admin-post.php. Successful exploitation of this vulnerability could allow for remote code execution with elevated privileges.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply appropriate updates provided by WordPress manually to affected systems, immediately after appropriate testing.
  • Apply the Principle of Least Privilege to all systems and services.
  • Verify no unauthorized system modifications have occurred on system before applying patch.
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Protect Your Systems from Cyber Threats Like This

CIS Controls That Help Avoid This Issue Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation Arrow CIS Control 18: Application Software Security

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0

Pencil Blog post 25 Apr 2019
CONTROL: 2 --- ADVISORY CONTROL: 0
CONTROL: 3 --- ADVISORY CONTROL: 0
CONTROL: 4 --- ADVISORY CONTROL: 0