WordPress WooCommerce Gift Card Plugin Vulnerability

A critical WordPress plugin vulnerability tracked as CVE-2022-45359 with a CVSS v3: 9.8, has been exploited in wild by the threat actors.

The vulnerability affecting the WordPress plugin YITH WooCommerce Gift Cards Premium that allows websites of online stores to sell gift cards, a WordPress plugin used on over 50,000 websites.

The CVE-2022-45359 flaw is an Arbitrary File Upload issue that can allow an unauthenticated attacker to upload files to vulnerable sites, including web shells that provide full access to the site.

The researchers were able to reverse engineer the exploit and discovered that the issue lies in import_actions_from_settings_panel function which runs on the admin_init hook which runs for any page in the /wp-admin/ directory and allows to trigger functions that run on it as an unauthenticated attacker by sending a request to /wp-admin/admin-post.php.

The experts noticed that the import_actions_from_settings_panel function also lacks a capability check and a CSRF check. An unauthenticated attacker can send POST requests to “/wp-admin/admin-post.php” using the certain parameters to upload a malicious PHP executable on the site.

Researchers added that it is possible to discover the attacks by analyzing the logs and checking unexpected POST requests to wp-admin/admin-post.php from unknown IP addresses.

Below are some files uploaded by threat actors in attacks analyzed by Wordfence:

• kon.php/1tes.php – this file loads a copy of the “marijuana shell” file manager in memory from a remote location (shell[.]prinsh[.]com)
• b.php – this file is a simple uploader
• admin.php – this file is a password-protected backdoor

The attacks observed by Wordfence originated from 103.138.108.15 (19604 attacks against 10936 different sites) and 188.66.0.135 IP addresses (1220 attacks against 928 sites). Most of them have occurred after the vulnerability disclosed

A lot many websites are still using vulnerable versions of the plugin, and threat actors are exploring the flaw in attacks in the wild to upload backdoors on the e-stores.

The issue was discovered on November 22, 2022 and was addressed with the release of version 3.20.0.