Discontinued WordPress Plugin Flaw Exposes Websites to Cyber Attacks

A critical vulnerability was discovered in two plugins developed by miniOrange.

The affected plugins, miniOrange’s Malware Scanner and Web Application Firewall, contained a severe privilege escalation flaw that could allow unauthenticated attackers to gain administrative access to WordPress sites.

This discovery underscores website administrators’ ongoing risks and challenges in securing their digital assets against sophisticated cyber threats.

CVE-2024-2172: A Critical Vulnerability

The core of the issue lies in a privilege escalation vulnerability identified under the CVE ID CVE-2024-2172. It has a CVSS score of 9.8, indicating a critical level of severity.

Document

Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities. :

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

This flaw was present in versions up to and including 4.7.2 of the Malware Scanner plugin and 2.1.1 of the Web Application Firewall plugin.

The vulnerability allowed unauthenticated individuals to escalate their privileges to that of an administrator by updating the user password through a missing capability check in the mo_wpns_init() function.

Discovery and Response

The vulnerability was discovered by a researcher named Stiofan, who reported it through the Wordfence Bug Bounty Program during their second Bug Bounty Extravaganza on March 1, 2024.

Wordfence, a leading provider of WordPress security solutions, confirmed the flaw and identified that it also affected the miniOrange’s Web Application Firewall plugin.

In recognition of the discovery, Stiofan was awarded a bounty of $1,250.00.

Wordfence acted swiftly to mitigate the risk posed by this vulnerability.

On March 4, 2024, Premium, Care, and Response users of Wordfence received a firewall rule to protect against exploits targeting this flaw.

Users of the accessible version of Wordfence were scheduled to receive the same protection on April 3, 2024.

Upon notification of the vulnerability, miniOrange responded by permanently closing the affected plugins on March 7, 2024, leaving no patch or update available for users.

This drastic measure highlights the severity of the vulnerability and the potential risks to WordPress sites if left unaddressed.

This incident is a stark reminder of the importance of maintaining up-to-date security measures for WordPress sites.

Website administrators are urged to delete the affected miniOrange plugins from their sites immediately and seek alternative solutions to ensure their digital assets remain secure.

Collaborative Efforts in Cybersecurity

The discovery and resolution of this vulnerability demonstrate the critical role of bug bounty programs and collaborative efforts between security researchers and plugin developers in identifying and mitigating security risks.

The Wordfence Bug Bounty Program, in particular, has proven invaluable in securing the WordPress ecosystem by encouraging researchers to report vulnerabilities responsibly.

The discontinuation of miniOrange’s Malware Scanner and Web Application Firewall plugins after discovering a critical privilege escalation vulnerability is a cautionary tale for the WordPress community.

It underscores the need for continuous vigilance, timely updates, and collaborative security efforts to protect against the ever-evolving landscape of cyber threats.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

2 days ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

4 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

4 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago