A bug recently found in a popular WordPress plugin (opens in new tab) could have put thousands of sites at risk of running malicious web scripts against unsuspecting visitors.
The vulnerability, discovered by the Wordfence Threat Intelligence (opens in new tab) team, was found in the “WordPress Email Template Designer - WP HTML Mail”, a plugin that simplifies designing custom emails for websites running on the WordPress website builder (opens in new tab).
Some 20,000 websites have the plugin up and running.
The researchers reached out to the plugin’s developers, and a patch was issued on January 13. The Wordfence Threat Intelligence Team urges all WordPress (opens in new tab) administrators running the email template designer plugin to update it to version 3.1 immediately.
Further detailing the vulnerability, the researchers said the plugin registers two REST-API routes, used to retrieve, and update, email template settings. As these were “insecurely implemented”, unauthenticated users could access these endpoints.
“The plugin registers the /themesettings endpoint, which calls the saveThemeSettings function or the getThemeSettings function depending on the request method. The REST-API endpoint did use the permission_callback function, however, it was set to __return_true which meant that no authentication was required to execute the functions. Therefore, any user had access to execute the REST-API endpoint to save the email’s theme settings or retrieve the email’s theme settings,” the researchers explained.
“As always, cross-site scripting vulnerabilities can be used to inject code that can add new administrative users, redirect victims to malicious sites, inject backdoors into theme and plugin files, and so much more,” they concluded.
All of this means there’s a “high chance” malicious attackers can obtain admin user access on sites running the unpatched version of the plugin.
- You might also want to check out our list of the best website hosting service providers right now