The United States Government National Vulnerability Database (NVD) published an advisory about a vulnerability discovered in the WP Statistics WordPress plugin that affects up to 600,000 active installations.
The vulnerability was assigned a medium threat level score of 6.5 out of a scale of 1 to 10, with level 10 representing the most severe vulnerability level.
WP Statistics Cross-Site Request Forgery (CSRF)
The WP Statistics plugin was found to contain a Cross-Site Request Forgery vulnerability that could allow an attacker to compromise a website by activating or deactivating plugins.
A Cross-Site Request Forgery is an attack that requires a registered website user (such as an administrator) to perform an action like a clicking a link, which then allows an attacker to take advantage of a security gap.
The security gap in this instance is a “missing or incorrect nonce validation.”
A WordPress nonce is a security token that’s provided to a registered user that allows that user to securely perform actions that only a registered user can do.
The WordPress developer pages explains the nonce with the example of an administrator deleting a post.
WordPress might generate a URL like this when an administrator level user deletes a post.
Below is hypothetical example of a URL generated when deleting a post with an ID number of 123:
http://example.com/wp-admin/post.php?post=123&action=trash
A registered WordPress site admin would pick up a nonce and the URL, in the example, may look like this:
http://example.com/wp-admin/post.php?post=123&action=trash&_wpnonce=b192fc4204
That last part, &_wpnonce=b192fc4204, is the nonce.
So, what’s happening is that the nonce is either missing or not properly validated within the WP Statistics plugin and that creates a security gap for a malicious hacker to exploit.
The National Vulnerability Database (NVD) explains it like this:
“The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function.
This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.”
CSRF Vulnerability Patch
WP Statistics plugin vulnerability affects version up to an including 13.1.1. However there have been numerous security fixes added since then, including in version 13.2.11, plus additional fixes after that.
The current version of the plugin is 14.0.1. At this time only 29.3% of users are using the most up to date version.
Users of the outdated version of the plugin may want to consider updating to the latest version.
Read the NVD security advisory:
Featured image by Shutterstock/Asier Romero
!function(f,b,e,v,n,t,s) {if(f.fbq)return;n=f.fbq=function(){n.callMethod? n.callMethod.apply(n,arguments):n.queue.push(arguments)}; if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0'; n.queue=[];t=b.createElement(e);t.async=!0; t.src=v;s=b.getElementsByTagName(e)[0]; s.parentNode.insertBefore(t,s)}(window,document,'script', 'https://connect.facebook.net/en_US/fbevents.js');
if( typeof sopp !== "undefined" && sopp === 'yes' ){ fbq('dataProcessingOptions', ['LDU'], 1, 1000); }else{ fbq('dataProcessingOptions', []); }
fbq('init', '1321385257908563');
fbq('track', 'PageView');
fbq('trackSingle', '1321385257908563', 'ViewContent', { content_name: 'wp-statistics-wordpress-vulnerability', content_category: 'news wp' }); } });
