WordPress Plugin Bug Lets Subscribers Wipe Sites
The flaw, found in the Hashthemes Demo Importer plugin, allows any authenticated user to exsanguinate a vulnerable WordPress site, deleting nearly all database content and uploaded media.
<div class="c-article__content js-reading-content"> <p>Researchers have discovered a homicidal WordPress plugin that allows subscribers to wipe sites clean of content.</p> <p>The high-severity security flaw is found in <a href="https://wordpress.org/plugins/hashthemes-demo-importer/" target="_blank" rel="noopener">Hashthemes Demo Importer</a>, a plugin that’s used in more than 8,000 active installations.</p> <p>According to security researchers at Wordfence, the vulnerability allows any authenticated user to completely exsanguinate a vulnerable site, “permanently deleting nearly all database content as well as all uploaded media.”</p> <p><a href="https://threatpost.com/infosec-insider-subscription-page/?utm_source=ART&utm_medium=ART&utm_campaign=InfosecInsiders_Newsletter_Promo/" target="_blank" rel="noopener"><img loading="lazy" class="aligncenter wp-image-168544 size-full" src="https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/infosec_insiders_in_article_promo.png" alt="Infosec Insiders Newsletter" width="700" height="50"></a></p> <p>The HashThemes Demo Importer plugin is designed to let admins easily import demos for WordPress themes with a single click, without having to deal with dependencies such as XML files, .json theme options,.dat customizer files or .wie widget files.</p> <p>In a Tuesday <a href="https://www.wordfence.com/blog/2021/10/site-deletion-vulnerability-in-hashthemes-plugin/" target="_blank" rel="noopener">writeup</a>, Wordfence’s Ram Gall said that the Wordfence Threat Intelligence team initiated the disclosure process for the bug on Aug. 25. For nearly a month, the developer failed to respond, so Wordfence got in touch with the WordPress plugins team on Sept. 20.</p> <h2>WordPress Yanks Plugin, Puts Out Fix Lickety-Split</h2> <p>On the same day, the WordPress crew temporarily removed the Hashthemes Demo Importer from the repository, and a patched version was made available a few days later, on Sept. 24, although the plugin’s <a href="https://wordpress.org/plugins/hashthemes-demo-importer/#developers" target="_blank" rel="noopener">changelog</a> makes no mention of it.</p> <h2>Plugin Chopped Nearly Every Database Table</h2> <p>Wordfence’s Gall explained that the Hashthemes demo importer plugin hadn’t performed capability checks for many of its Ajax actions. Ajax is a JavaScript-based technology that allows a web page to fetch new information and present itself without refreshing the page.</p> <p>“While it did perform a nonce check, the AJAX nonce was visible in the admin dashboard for all users, including low-privileged users such as subscribers,” according to the Wordfence writeup. “The most severe consequence of this was that a subscriber-level user could reset all of the content on a given site.</p> <p>Specifically, any logged-in user could trigger the hdi_install_demo Ajax function and provide a reset parameter set to true, Gall wrote, resulting in the plugin running its database_reset function.</p> <p>“This function wiped the database by truncating every database table on the site except for wp_options, wp_users, and wp_usermeta,” Gall continued. “Once the database was wiped, the plugin would then run its clear_uploads function, which deleted every file and folder in wp-content/uploads.”</p> <h2>Let’s Hear It for Backups</h2> <p>Gall said that the vulnerability should remind us of the importance of backups for a site’s security. “While most vulnerabilities can have destructive effects, it would be impossible to recover a site where this vulnerability was exploited unless it had been backed up,” he wrote. Given that the vulnerability can lead to complete site takeover, he asked that if you know of somebody using this plugin on their site, please do give them a heads-up.</p> <h2>Plugins Expand the Attack Surface</h2> <p>Rick Holland, CISO and vice president of strategy at digital risk protection vendor Digital Shadows, noted that the plugin vulnerability highlights the increased attack surface that third-party code ushers in, as do browser extensions.</p> <p>That’s up to software vendors to deal with: “Software companies are responsible for their code and the code that runs on top of their code,” Holland told Threatpost via email.</p> <p>Jake Williams, co-founder and CTO at incident response firm BreachQuest, said that the incident highlights the complexity of vulnerability management. “Not only do organizations need to know the content management systems they are running, but also the plugins that are running on those systems too,” he told Threatpost on Wednesday. “This is yet another example of supply chain security where the WordPress system was trustworthy, but the plugin (which the security team probably doesn’t even know was installed) left them vulnerable.”</p> <h2>Only Brats Demolish Sites</h2> <p>Williams also noted that this kind of flaw attracts jerks, as opposed to financially motivated attackers. “I don’t think the majority of threat actors are interested in wiping databases and content in WordPress sites,” he told Threatpost on Wednesday. “It’s counter to the goals of most threat actors. That said, I do expect that some people will go and target these systems for fun, so it is a serious risk.”</p> <p>Holland concurred: “Destructive threat actors, hacktivists, or actors deleting sites for the ‘lulz’ would be most interested in this sort of vulnerability,” he said.</p> <p>It wouldn’t be tough to take advantage of such a flaw, either, Holland added: “Exploiting this vulnerability does require authentication, but given password use and account takeovers, that bar isn’t as high as it should be.”</p> <h2>How to Weave Security Into WordPress</h2> <p>Leo Pate, managing consultant at application security company nVisium, noted that WordPress is just like any software: Namely, it’s made by fallible humans. “Its developers and those that make WordPress components, such as plugins and templates, are bound to make mistakes,” he said in an email to Threatpost on Wednesday. He sent over the following cheatsheet on how to look holistically at a WordPress environment and how to incorporate security into all of its components: server, network and app layers.</p> <p>His advice includes:</p> <ul> <li style="font-weight: 400">Not running the WordPress server’s services as administrative users</li> <li style="font-weight: 400">Ensure that all programs installed on the server, as well as the server itself, remains up to date with the latest patches</li> <li style="font-weight: 400">The server only allows connections over TLSv1.2 or TLSv1.3, the ciphers used for those connections should provide perfect forward secrecy, and the domain should participate in certificate transparency</li> <li style="font-weight: 400">Default user credentials should be changed on the WordPress instance as well as the database credentials (if not done during the initial setup)</li> <li style="font-weight: 400">Any plugins or templates used within WordPress should be from reputable sources and be kept up to date.</li> </ul> <p>Within the WordPress plugin portal, users can see information that includes:</p> <ul> <li style="font-weight: 400">When the plugin was last updated</li> <li style="font-weight: 400">Review or comments about the plugin from users</li> <li style="font-weight: 400">How many times it has been installed There are still a good number of things users could do to protect their WordPress websites that aren’t listed here. Some really good resources for further information include the Center for Internet Security Benchmark documentation (<a href="https://learn.cisecurity.org/benchmarks" target="_blank" rel="noopener">https://learn.cisecurity.org/benchmarks</a>) and the WordPress security documentation (<a href="https://wordpress.org/support/category/security" target="_blank" rel="noopener">https://wordpress.org/support/category/security</a>).</li> </ul> <p><em><strong>Check out our free </strong></em><a href="https://threatpost.com/category/webinars/" target="_blank" rel="noopener"><em><strong>upcoming live and on-demand online town halls</strong></em></a><em><strong> – unique, dynamic discussions with cybersecurity experts and the Threatpost community.</strong></em></p> <footer class="c-article__footer"> <div class="c-article__footer__container"> <div class="c-article__footer__col"> <a href="#discussion" class="c-button c-button--secondary">Write a comment</a> </div> <div class="c-article__footer__col"> <div class="c-article__sharing"> <p><strong>Share this article:</strong></p> <nav class="c-nav-sharing"> <div class="social-likes social-likes_notext" data-title="WordPress Plugin Bug Lets Subscribers Wipe Sites" data-url="https://threatpost.com/wordpress-plugin-bug-wipe-sites/175826/" data-counters="no" data-zeroes="yes"><div class="facebook" title="Share via Facebook"></div> <div class="twitter" title="Share via Twitter"></div><div class="linkedin" title="Share via LinkedIn"></div> <div class="reddit" title="Share via Reddit"></div> <div class="flipboard" title="Share via Flipboard"></div> </div> </nav> </div> </div> </div> <div class="c-article__footer__container"> <div class="c-article__footer__col"></div> <div class="c-article__footer__col"> <ul class="c-list-categories"> <li><a class="c-label c-label--secondary-transparent" href="https://threatpost.com/category/vulnerabilities/">Vulnerabilities</a></li> <li><a class="c-label c-label--secondary-transparent" href="https://threatpost.com/category/web-security/">Web Security</a></li> </ul> </div> </div> </footer> </div>
