A bug recently found in a popular WordPress plugin could have put thousands of sites at risk of running malicious web scripts against unsuspecting visitors.
The vulnerability, discovered by the Wordfence Threat Intelligence team, was found in the “WordPress Email Template Designer – WP HTML Mail”, a plugin that simplifies designing custom emails for websites running on the WordPress website builder.
Some 20,000 websites have the plugin up and running.
WordPress worries
According to the researchers, the flaw allowed for an unauthenticated attacker to inject malicious JavaScript, that would run whenever a site admin accesses the template editor. What’s more, the vulnerability would let them modify the email template, adding arbitrary data which could be used in a phishing attack against the email’s recipients.
The researchers reached out to the plugin’s developers, and a patch was issued on January 13. The Wordfence Threat Intelligence Team urges all WordPress administrators running the email template designer plugin to update it to version 3.1 immediately.
Further detailing the vulnerability, the researchers said the plugin registers two REST-API routes, used to retrieve, and update, email template settings. As these were “insecurely implemented”, unauthenticated users could access these endpoints.
Injecting backdoors
“The plugin registers the /themesettings endpoint, which calls the saveThemeSettings function or the getThemeSettings function depending on the request method. The REST-API endpoint did use the permission_callback function, however, it was set to __return_true which meant that no authentication was required to execute the functions. Therefore, any user had access to execute the REST-API endpoint to save the email’s theme settings or retrieve the email’s theme settings,” the researchers explained.
The functionality allows for the implementation of setting changes to the email template, which means a malicious actor could “easily” transform it into a tool for phishing, the researchers further stated. They could even add malicious JavaScript into the template.
“As always, cross-site scripting vulnerabilities can be used to inject code that can add new administrative users, redirect victims to malicious sites, inject backdoors into theme and plugin files, and so much more,” they concluded.
All of this means there’s a “high chance” malicious attackers can obtain admin user access on sites running the unpatched version of the plugin.
