CIS Logo
tagline: Confidence in the Connected World

A Vulnerability in WordPress WP GDPR Compliance Plugin Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2018-127

DATE(S) ISSUED:

11/14/2018

OVERVIEW:

A vulnerability has been discovered in the WordPress WP GDPR Compliance Plugin that could allow for arbitrary code execution. WordPress is a web-based publishing application implemented in PHP, and the WP GDPR Compliance Plugin assists website owners with the European privacy regulations known as GDPR. Successful exploitation of this vulnerability could allow for arbitrary code execution with elevated privileges.

THREAT INTELLIGENCE:

A Proof-of-Concept has been developed by the researchers who discovered this vulnerability to demonstrate this issue. There are reports of this actively being exploited in the wild in November 2018.

SYSTEMS AFFECTED:

  • WordPress WP GDPR Compliance Plugin 1.4.2 and prior

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in the WordPress WP GDPR Compliance Plugin that could allow for arbitrary code execution. This vulnerability exists because it fails to properly sanitize the 'save_setting' action. An attacker can exploit this issue by injecting arbitrary commands, which get stored until the plugin reaches its 'do_action()' call. Successful exploits may allow an attacker to gain administrative access to the site and make direct changes, including uploading malicious plugins for future attacks. Successful exploitation of this vulnerability could allow for arbitrary code execution with elevated privileges.

RECOMENDATIONS:

We recommend the following actions be taken:

  • Apply appropriate updates provided by WordPress manually to affected systems, immediately after appropriate testing.
  • Apply the Principle of Least Privilege to all systems and services.
  • Verify no unauthorized system modifications have occurred on system before applying patch.
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Protect Your Systems from Cyber Threats Like This

CIS Controls That Help Avoid This Issue Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation Arrow CIS Control 18: Application Software Security