The WP Maps Pro plugin is frequently used by WordPress site administrators to integrate Google Maps into their web pages, enhancing the site layout and functionality with heavy-duty mapping capabilities. This plugin, developed by Flippercode, allows for the dynamic showcasing of various locations with the ability to draw routes and multiple map layers, supporting advanced customizations and themes. Widely adopted in industries requiring localization services, it is essential for businesses enhancing geographic presence management. The plugin aids in integration tasks, often replacing manual embed methods for displaying visual GIS data on websites. WP Maps Pro is employed in various verticals, from tourism to retail, providing web administrators with easy-to-use interface tools.
The vulnerability exists in WP Maps Pro where its wp-google-map-gold add-on, up to version 6.1.0, is compromised by allowing unauthenticated users to create administrator accounts. This flaw is facilitated by inadequate access control on the AJAX action, leading to privilege escalation. An unauthenticated attacker exploits a publicly accessible nonce to bypass the intended authentication checks. This issue is critical because it allows remote threat actors to establish administrative control over a WordPress site. Without adequate protections, any anonymous user could exploit this vulnerability to gain full administrator privileges.
By manipulating browser HTTP requests, a remote attacker can send specially crafted POST requests to take advantage of a publicly embeddable nonce in the plugin's JavaScript payload. The vulnerability resides in the 'wpgmp_temp_access_ajax' AJAX action which is improperly secured, leveraging nonces sent via the 'wpgmp_local' object. With the nonce obtainable from the public page source, a POST request exploiting this gives attackers WP admin rights. The attack circumvents user privilege checks due to improper validation mechanics on the server side, leading to complete hostile control of the site backend through forged account creation.
Exploitation of this vulnerability could result in a website being fully compromised, with attackers potentially executing arbitrary administrative functions without restriction. This includes altering or deleting content, adding malicious scripts or backdoors, and furthering attacks against the server's infrastructure. The ability to forge administrator sessions allows extensive malicious operations, such as defacing websites, stealing sensitive user information, or deploying malware. These actions could severely impact site integrity, visitor trust, and business operations for affected organizations.
REFERENCES
- Update to WP Maps Pro version beyond 6.1.0 to close the unauthorized account creation pathway.
- Implement additional authentication checks on AJAX endpoints to prevent similar privilege escalation issues in the future.
- Regularly audit plugins for potential security vulnerabilities and apply prompt updates from trusted vendors.
- Conduct security training for developers on secure coding practices, particularly in handling client-server interactions.
- Activate two-factor authentication for WordPress admin accounts to add an extra layer of security.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →