WordPress WP-Advanced-Search <= 3.3.3 - Unauthenticated Database Export

2020-03-05 00:00
Florian Hauser

Strategic Overview

Status
Patched in 3.3.4
Affected Plugin
WordPress WP-Advanced-Search
Affected Version
<= 3.3.3
CVSS
8.6High
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE pending
View all WordPress WP-Advanced-Search vulnerabilities

At a glance

This record tracks a high-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the WordPress WP-Advanced-Search WordPress plugin, affecting versions <= 3.3.3. It carries a CVSS score of 8.6 (reachable over the network; low attack complexity; high confidentiality impact). Exploitation requires no authentication. The issue is fixed in version 3.3.4; sites on affected versions should update now. Disclosed March 2020, reported by Florian Hauser.

Vulnerability Overview

The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to unauthenticated database export in versions up to, and including, 3.3.3 via the WP_Advanced_Search_Export() function which makes it possible for unauthenticated attackers to export a vulnerable site's entire database. This is due to the WP_Advanced_Search_Export() function being hooked via an admin_post_nopriv action that is available to all users.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

WordPress WP-Advanced-Search <= 3.3.3 carries this weakness at WP_Advanced_Search_Export(), and reaching it takes no account at all. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For WordPress WP-Advanced-Search the fix is 3.3.4: builds <= 3.3.3 are affected, anything from 3.3.4 onward is not.

Remediation

Update to version 3.3.4, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: WordPress WP-Advanced-Search 3.3.4 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/b71e6219-09cc-484e-8c48-536797d974ce

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C