Two critical and high severity security vulnerabilities in “All in One” SEO WordPress plugin exposed over 3 million websites to takeover attacks. A critical Authenticated Privilege Escalation bug (CVE-2021-25036) and a high severity Authenticated SQL Injection (CVE-2021-25037). The plugin’s developer released a security update to address both All in One bugs on December 7, 2021.
More than 820,000 sites using the plugin are yet to update their installation, according to download statistics for the last two weeks since the patch was released, and are still exposed to attacks. To exploit the vulnerabilities requires threat actors to be authenticated, they only need low-level permissions such as Subscriber a default role to abuse them in attacks.
Although subscribers are typically only able to edit their own profile besides posting comments, in this case, they can exploit CVE-2021-25036 to elevate their privileges and gain remote code execution on vulnerable sites and, likely, completely take them over.
Escalating privileges by abusing CVE-2021-25036 is an easy task on sites running an unpatched All in One SEO version by “changing a single character to uppercase” to bypass all implemented privilege checks.An attacker could abuse this feature to hide .htaccess backdoors and execute malicious code on the server.
WordPress admins still using All In One SEO versions affected by these severe vulnerabilities (between 4.0.0 and 188.8.131.52) who haven’t already installed the 184.108.40.206 patch are advised to do it immediately.