CVE-2022-34487 Scanner

Shortcode Addons is a popular WordPress plugin utilized by website administrators and developers to enhance the visual design of their WordPress sites by adding shortcodes. It is primarily used by individuals looking to improve site aesthetics through customizable styling options without needing advanced coding skills. This plugin allows easy integration of design elements into WordPress sites, thus making it a valuable tool for bloggers, small business owners, and developers. Due to its wide range of features, it is commonly used in the WordPress ecosystem to add stylistic improvements to posts and pages, making websites more appealing. Many users rely on its extensive library of design elements to enhance the functionality and look of their WordPress-powered websites. By facilitating easy-to-use customization, it helps users achieve professional results without needing in-depth design knowledge.

The vulnerability in question is an unauthenticated arbitrary option update, allowing attackers to modify plugin options without proper authentication checks. This critical flaw stems from inadequate access controls, making it possible for adversaries to tamper with settings inside the plugin. Attackers could exploit this issue to cause site defacement, data alteration, or lead to further exploits within the WordPress site as a whole. The vulnerability presents significant risks due to its ability to be exploited without requiring authentication, increasing the ease with which attacks can be executed. This lack of proper validation checks permits malicious actors to manipulate sensitive areas of the plugin, thus destabilizing and compromising entire WordPress sites. Consequentially, site owners might find their data integrity breached, homepages defaced, or administrative functionalities exploited.

The vulnerability resides in the plugin's functionality that processes options updates through HTTP requests without adequate authentication controls. Malicious users can directly access the endpoint at '/wp-json/ShortCodeAddonsUltimate/v2/addons_settings' and manipulate parameters. Vulnerable parameters such as "rawdata" can be exploited by injecting arbitrary values, as the server does not authenticate these requests properly. By altering configuration data in this manner, attackers bypass security protocols and make significant unauthorized changes. The critical nature of this issue is exacerbated by the fact that the plugin does not adequately validate incoming requests, thus giving rise to potential exploits. The flaw is triggered when the malicious HTTP POST request, crafted to contain arbitrary data, meets a 200 OK status, indicating successful unauthorized modifications.

When malicious actors exploit this vulnerability, they can inflict serious damage on WordPress sites using Shortcode Addons. Potential consequences include unwarranted modifications to the site's appearance or functionality leading to vandalism or reputation damage. Attackers might manipulate vital settings, compromising data integrity and possibly leading to the loss of critical information or settings. This could open up opportunities for further compromise or data breaches, putting both site and user data at risk. In a broader context, successful exploitation can result in complete site corruption, leading to loss of access for legitimate users and administrators. Furthermore, this vulnerability can be a gateway for attackers to carry out additional exploits or move laterally within the web environment, further magnifying the risks associated with this flaw.

REFERENCES

• https://wpscan.com/vulnerability/c8dd91d5-fdc4-4852-9823-6d0047b214fe/
• https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-0-3-unauthenticated-arbitrary-option-update-vulnerability
• https://nvd.nist.gov/vuln/detail/CVE-2022-34487