Hackers exploit WordPress plugin flaw that gives full control of millions of sites

Hackers are actively exploiting critical vulnerabilities in widely used WordPress plugins, giving them complete control over millions of sites, researchers say.

This vulnerability has a severity rating of 8.8 out of 10 and exists in Elementor Pro, a premium plugin running on over 12 million sites using the WordPress content management system. Elementor Pro allows the user to create his website with high quality using various tools. One of them is another WordPress plugin, WooCommerce. Once these conditions are met, anyone with an account on the site (subscriber, customer, etc.) can create a new account with full administrative rights.

The vulnerability was discovered by Jerome Bruandet, a researcher at security firm NinTechNet. Last week Elementor, the developers of the Elementor Pro plugin, released version 3.11.7 which patched this flaw. In a post published Tuesday, Blouande wrote:

An authenticated attacker could use this vulnerability to create an administrator account by enabling registration (users_can_register) and set the default role (default_role) to “Administrator” and enter the administrator’s email address (admin_email) or redirect all traffic to an external malicious website as shown below. siteurl Among many other possibilities:

MariaDB [example]> SELECT * FROM `wp_options` WHERE `option_name`='siteurl';
+-----------+-------------+------------------+----------+
| option_id | option_name | option_value     | autoload |
+-----------+-------------+------------------+----------+
|		 1 | siteurl     | https://evil.com | yes 	 |
+-----------+-------------+------------------+----------+
1 row in set (0.001 sec)

Researchers at PatchStack, another security firm, are now reporting that this vulnerability is being actively exploited. Attacks are coming from various IP addresses, including:

• 193.169.194.63
• 193.169.195.64
• 194.135.30.6

Files uploaded to compromised sites often have the following names:

• wp-resortpack.zip
• wp-rate.php
• lll.zip

URLs of compromised sites are often changed to:

• over there[dot]tracker line[dot]Com

The broken access control vulnerability is due to Elementor Pro’s use of the ‘elementor-pro/modules/woocommerce/module.php’ component. While WooCommerce is running, this script registers his AJAX actions:

/**
 * Register Ajax Actions.
 *
 * Registers ajax action used by the Editor js.
 *
 * @since 3.5.0
 *
 * @param Ajax $ajax
 */
public function register_ajax_actions( Ajax $ajax ) 
   // `woocommerce_update_page_option` is called in the editor save-show-modal.js.
   $ajax->register_ajax_action( 'pro_woocommerce_update_page_option', [ $this, 'update_page_option' ] );
   $ajax->register_ajax_action( 'pro_woocommerce_mock_notices', [ $this, 'woocommerce_mock_notices' ] );

and

/**
 * Update Page Option.
 *
 * Ajax action can be used to update any WooCommerce option.
 *
 * @since 3.5.0
 *
 * @param array $data
 */
public function update_page_option( $data ) 
   update_option( $data['option_name'], $data['editor_post_id'] );

The update_option function is “intended to allow admins or shop managers to update certain WooCommerce options, but user input is not validated and the function restricts access to highly privileged users only.” There is no functional check to do,” explained Bruandet. He continued:

Elementor uses its own AJAX handler to manage most AJAX actions. pro_woocommerce_update_page_option,global elementor_ajax action. This can be found in the “elementor/core/common/modules/ajax/module.php” script in the free version (required to run Elementor Pro).

/**
 * Handle ajax request.
 *
 * Verify ajax nonce, and run all the registered actions for this request.
 *
 * Fired by `wp_ajax_elementor_ajax` action.
 *
 * @since 2.0.0
 * @access public
 */
public function handle_ajax_request() {
   if ( ! $this->verify_request_nonce() ) 
  	$this->add_response_data( false, esc_html__( 'Token Expired.', 'elementor' ) )
     	->send_error( Exceptions::UNAUTHORIZED );
   
   ...

Anyone using Elementor Pro should make sure they are running 3.11.7 or newer, as all previous versions are vulnerable. We also encourage these users to check the site for signs of infection listed in the PatchStack post.