WordPress Flaw + WooCommerce Vulnerability = Website Takeover

November 14, 2018
WordPress website

A design imperfection in the WordPress authorization framework utilized by modules and a document cancellation powerlessness in an extremely prominent eCommerce module called WooCommerce could enable assailants to increase full command over a WordPress site.

WooCommerce via Automatic is a famous WordPress module that adds eCommerce usefulness to a blog with the goal that webpage proprietors can have their very own stores. As indicated by the WooCommerce module page at WordPress.org, there are more than 4 million dynamic establishments of the module.

At the point when WordPress modules are introduced that use distinctive client jobs, rather than making their own validation framework, they use the WordPress authorization framework. Modules do this by making new jobs that are appointed diverse WordPress abilities and afterward use module capacities to restrict how these jobs can cooperate with different clients or settings in WordPress.


As per new research by Simon Scannell, a scientist for PHP Security firm RIPS Tech, when WooCommerce is introduced it will make a Shop Manager job that has the “edit_users” WordPress ability/authorization. This capacity enables clients to alter ANY WordPress client, including the Administrator account.

The imperfection with WordPress module/benefit framework is that if the WooCommerce module is debilitated, the capacity that limits what clients a Shop Manager can alter is not any more open and hence Shop chiefs can alter clients in the Administrator job.


The best way to incapacitate a module, however, is by utilizing an Administrator account or by erasing the records related with the module.

This is the place a record erasure powerlessness found by RIPS Tech becomes an integral factor.

Record erasure vuln + WordPress configuration imperfection = Pwn

Utilizing RIPS code examination programming, Scannell could find a record erasure weakpoint in WooCommerce 3.4.5 and prior. This weak point was in the module’s log erasure usefulness that Shop Manager approach.

Utilizing the weak point a client who was in the Shop Manager job could escape out of the normal envelope by including .. to the passed contention.

The weakness, however, illustrates how the authorization frameworks for modules can be exploited by utilizing a weak point that would not typically permit a site takeover.

This weak point was repaired on October eleventh in WooCommerce adaptation 3.4.6.

While WordPress can be arranged to consequently refresh all modules, Scannel disclosed to BleepingComputer this isn’t empowered of course and in this way numerous clients may in any case be running more seasoned powerless renditions of the WooCommerce module.

Along these lines it is essential that all clients check the adaptation of the introduced module, and if its more established than variant 3.4.6, move up to the most recent rendition.

About the author

Leave a Reply