This vulnerability makes it possible for attackers to upload malicious files to a WordPress site.
Wordfence-Logo.png (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLfG3kWDcV1-WJV7CgGlGW4pR_ss3D4WktW8J2hhT4THvRnW7_tf3b24rx4pW52sB_D1WbYFkW3QgfDg1CgC60W4y-LPm5B9bqcW1c9JVl8PRsXJW862mbD6K1KN0N2TnQ29yqFkSV8DBN68FYRlGW5zczd72rKN2JV_YkxF6wLgNfW4cWtDn1PGZNPW4LPNNw4vYDx4VTW31G55B-vcW1n2T6d21_Jcz3jSg1 )
FeaturedImage_Wordfence_22.01 (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
On June 19, 2023, the Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Arbitrary File Upload vulnerability in WPEverest’s User Registration plugin, which is actively installed on more than 60,000 WordPress websites. This vulnerability makes it possible for an authenticated attacker with minimal permissions, such as a subscriber, to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server.
Wordfence Premium (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYBqW8kzz6V2RVp1bW8lNwqB3W2523N36SL9TCPL1gW6KdN83576p_2W7dVzPc8mP_wWW4dfTrj5NSxjrN1nz4Z9Khfx_W15MZnh2xW2zYW3h3qkJ2Nx8h0W4SSjQ16hxP6tN6J3Mw1zrtsyW7Z-r3x4bwbDQV55q6f5TdzWVW3Q-qLY1pXDsZW68CVzT8tRKVgW6Z_Ly-8mrp5nW3WY24j9c0HJCW7kXqz85VTHqfW4v8WrY7bXfwvW33LZKT6ygg1k3nBs1 ) , Wordfence Care (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgzRcW7nRv0m5vcgCFW8M-2CS2VCJgwW4N9bFl8_f1WsN67YHSMSWWkrW4DR0ZG8TjjNvW7jKPvC17c8Q-W1x906X7SnRj3W8v5zPC8M6gjPN5mjFppTW5vhW49hfYZ2w6Kg1W6XV2r9972SkqW1s9bwz6Bh9jGW5wmhB24gRcZpW32fccZ8hWRbFVfd-Yx8J13CJV8d0nJ8N4KnjW13_CnS75wG5-W2Gyzjt8R7CPlW21PRg52kNP1jW3sQ_fx2673Xk3nTk1 ) , and Wordfence Response (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYD2W6YNQ96888-rfW9hpBMb7L4_30W6_tH-x3GpWHBW15Qd7V2ShpGVW7P3pCt36M600W95lysJ1TYwcMW4KrK7Y1y6mjDW31gVyQ88Vr-NN7Wqn_gjKTMtW6gF1403V1XVjW1sV-Jp7znzCMW7KNxcL34pq41W2k3YqL4VZt1bW70XtMf65ykJxW6BJNPl5q7s4FW3tFCyc4jqM3kW8JC3Zq5v_StBW5d-nJH1ZB0MgW2vJkTw4Bd9ZrW6VqNpS6YHTTw3nNX1 ) users received a firewall rule to protect against any exploits targeting this vulnerability on June 20, 2023. Sites still using the free version of Wordfence will receive the same protection on July 20, 2023.
We contacted WPEverest on June 19, 2023, and received a response the same day. After we provided full disclosure details, the developer released the first patch, which did not fully address the vulnerability, in version 3.0.2 on June 29, 2023. A fully patched version, 3.0.2.1, was released on July 4, 2023. We would like to commend the WPEverest development team for their prompt response and timely patch.
We urge users to update their sites with the latest patched version of User Registration, which is version 3.0.2.1 at the time of this writing, as soon as possible.
READ THIS POST ON THE BLOG
(
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
Vulnerability Summary from Wordfence Intelligence
Description: User Registration <= 3.0.2 – Authenticated (Subscriber+) Arbitrary File Upload (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLfZ5js6JV3Zsc37CgGDKVyLLxm4Sm-29W2z_S1F8HY5srW6j_TSj2N1sL0W68w0KK3w3t8qW78Q7tb2h5KPPW8_R_gF3M43KTVv0-FX2YFFNQW7P3kg-6XJ_bnW2vyxNx82WrFVW6QKmSr1wc586W2DJZcL2z7JX9W4W9hJd1b0yqPW5MwG-f26RzD0W1WCL9M1LbXpvN4f7jBdVBhMZW5LP1Kl66S96GW6MGCyq6FLdDWVQVSv893c6VhW6XN1jw63qHbsW8BQQJz4XTh_lVJ9S_f69TXYvW3zYwss8DBwvLW8WcqMD4d9sTbW4sxWC_953HSLW1mVVtM85JVMrW8Yj73c4F-6XrW371_QY5_7YQ0W4v1bjs6-Z01zW9dSsDm2-pZ1dW9kv83k5TNyYCW51zrFr5KLMWxW87yX9G16jY65W4vzgD05xTZmrN8XLr30ldFkW36h71 )
Affected Plugin: User Registration – Custom Registration Form, Login Form And User Profile For WordPress
Plugin Slug: user-registration
Affected Versions: <= 3.0.2
CVE ID: CVE-2023-3342
CVSS Score: 9.9 (Critical)
CVSS Vector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Researcher/s: Lana Codes (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgS3kWFpV1-WJV7CgBdGW7VHfKN4PvSD7W1vYVLz2vNq4kVhjpYl1-Y6M4W6-v6w7650x--W8ZfCzm4Y5m5hN6xHsqYnHxVbW9jpkgf8sK-sBW4DGKN2297TFkN6j_Hg3Bt7vJMmxL1G-QrSkW44xw5y2fBh7rW85bbgf9d6dTgW8tWmvT14QXF9W1N35LK3j2DrpW4hR4xW4sqlbfW5Wb8tl8sc2SFW1-HJdY3PM_-BW1dBc3_4J3x50W8Kh_dq1mGHfbW7zCWw919mkd7N3lf8YLwHr_yW6sPRXG2yQyzSW5-fq3Q6ZrZN4V83tFd6wdG3Y3hqc1 )
Fully Patched Version: 3.0.2.1
The User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to a hardcoded encryption key and missing file type validation on the ‘ur_upload_profile_pic’ function in versions up to, and including, 3.0.2. This makes it possible for authenticated attackers with subscriber-level capabilities or above to upload arbitrary files on the affected site’s server which may make remote code execution possible. This was partially patched in version 3.0.2 and fully patched in version 3.0.2.1.
Technical Analysis
The User Registration plugin provides a versatile drag and drop registration form builder, with custom fields and unlimited customization options. It also provides a login form. After logging in, it provides users with a profile that allows various types of customization, including uploading a profile picture.
Examining the code reveals that the plugin uses two separate functions to set the profile picture. The first AJAX function uploads the profile picture to a temp folder, and the second request moves the file and sets the profile picture to the user.
The profile_pic_upload() function uses a generic image upload solution, which checks the file extension and then uploads the image to the temp folder. The interesting part is that the data from the uploaded file is encrypted within the AJAX response:
[VIEW THIS CODE SNIPPET ON THE BLOG] (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
JSON response after the file upload in the profile_pic_upload() function
The encrypted upload_files data in the response is something like this:
upload_files-response (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
Encryption is used due to the way the plugin handles uploads because the encrypted data is decrypted and used to determine the filename and filepath where the file is saved for the user. However, for data to be encrypted and decrypted, an encryption key is required. As a general rule, encryption keys should be confidential and unique to each website.
[VIEW THIS CODE SNIPPET ON THE BLOG] (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
We unfortunately found that the encryption key is hardcoded in vulnerable versions of the plugin in the crypt_the_string() function, which means that threat actors also had access to the key which was not unique per WordPress installation. This makes it possible for attackers to craft an uploaded files data array payload that can be used to modify the filename, path, and extension when saving the profile picture.
The plugin calls the function ur_upload_profile_pic() when saving the profile, which contains the following code:
[VIEW THIS CODE SNIPPET ON THE BLOG] (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
Rename and move the file in ur_upload_profile_pic() function
The function decrypts the encrypted file data, which is specified in the save request. Based on this data, the file in the temp folder is moved and renamed using the rename() php function. Unfortunately, however, there is no file type check before it, which means that the image file can be renamed to a file with any type of extension, such as .php, .phtml, .html, and more.
Exploit Possibilities
Exploiting the vulnerability requires multiple complex steps, as two separate functions and requests must be used to upload and move the file:
- Register a user
- Log in as the user (since it is only possible to upload a profile picture for the user)
- Upload the malicious exploit.png image file
- Retrieve the encrypted file data from the response
- Decrypt the file data
- Modify the file extension to php in the file name
- Encrypt the file data
- Save the profile with the encrypted and modified file data
Since it is only possible to upload an image file during the upload process, because its extension is checked, the initial step involves uploading a file named, for example, exploit.png as a profile picture with the following request:
user_registration_profile_pic_upload-http-request (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
In this scenario, the attacker uploads an exploit.png file, which is actually a PHP script, but with a .png extension:
[VIEW THIS CODE SNIPPET ON THE BLOG] (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
The response will be a json payload containing the encrypted result returned from the profile_pic_upload() function. The ‘upload_files’ parameter needs to be decrypted using the hardcoded key, which will return a serialized array, similar to this:
upload_files-array (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
The attacker would then change the file name from exploit.png to exploit.php and re-encrypt the array. The newly encrypted result can then be used when saving the profile in the next request:
save_profile_details-http-request (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
The exploit renames the image file to php and moves it to the profile pictures folder.
The complete exploit process looks like this:
user-registration-howto-wordfence (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
Wordfence Firewall
The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability.
user-registration-howto-wordfence-firewall (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLhL3kWGhV1-WJV7CgH0TW5b-f_R8-8sLwW7c11t01_P-zxW7C_gj01Z5-jjW62gQ8R7f0w79W2rgNJL4ZW_V9W4ZX-ls1C2vl_W5bjfv74HJymVW1WvPGb4wdHSlW3j1G8z4Rwkm0V5gn9V56q74dW6sjdBR29LxPDW86ZD-b5Rj6xbW3v25H36xmyFJW76G2Z78HD_VWM7Y84w_Z07SW6XFk-T7NFDy3W1QXm-J5RNH-6W8RsV_p5DrkkqW790nft8wtFdVW1dq6XQ3xMclMW1ZbctH3PpfGtW870hsK5RKDDQW5Lsfg882CxwYW5Nyss93gTkKzW4FV2Sj8cK15mW936zkP8m4HWhW1PN7sS9c4h4NW6W4cXC4Vy7shW3pG9lY6C89ZfW5xF6w53-GfHt383S1 )
Disclosure Timeline
June 19, 2023 – Discovery of the Arbitrary File Upload vulnerability in User Registration.
June 19, 2023 – We initiate contact with the plugin vendor asking that they confirm the inbox for handling the discussion.
June 19, 2023 – The vendor confirms the inbox for handling the discussion.
June 19, 2023 – We send over the full disclosure details. The vendor acknowledges the report and begins working on a fix.
June 20, 2023 – Wordfence Premium (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYBqW8kzz6V2RVp1bW8lNwqB3W2523N36SL9TCPL1gW6KdN83576p_2W7dVzPc8mP_wWW4dfTrj5NSxjrN1nz4Z9Khfx_W15MZnh2xW2zYW3h3qkJ2Nx8h0W4SSjQ16hxP6tN6J3Mw1zrtsyW7Z-r3x4bwbDQV55q6f5TdzWVW3Q-qLY1pXDsZW68CVzT8tRKVgW6Z_Ly-8mrp5nW3WY24j9c0HJCW7kXqz85VTHqfW4v8WrY7bXfwvW33LZKT6ygg1k3nBs1 ) , Care (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgzRcW7nRv0m5vcgCFW8M-2CS2VCJgwW4N9bFl8_f1WsN67YHSMSWWkrW4DR0ZG8TjjNvW7jKPvC17c8Q-W1x906X7SnRj3W8v5zPC8M6gjPN5mjFppTW5vhW49hfYZ2w6Kg1W6XV2r9972SkqW1s9bwz6Bh9jGW5wmhB24gRcZpW32fccZ8hWRbFVfd-Yx8J13CJV8d0nJ8N4KnjW13_CnS75wG5-W2Gyzjt8R7CPlW21PRg52kNP1jW3sQ_fx2673Xk3nTk1 ) , and Response (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYD2W6YNQ96888-rfW9hpBMb7L4_30W6_tH-x3GpWHBW15Qd7V2ShpGVW7P3pCt36M600W95lysJ1TYwcMW4KrK7Y1y6mjDW31gVyQ88Vr-NN7Wqn_gjKTMtW6gF1403V1XVjW1sV-Jp7znzCMW7KNxcL34pq41W2k3YqL4VZt1bW70XtMf65ykJxW6BJNPl5q7s4FW3tFCyc4jqM3kW8JC3Zq5v_StBW5d-nJH1ZB0MgW2vJkTw4Bd9ZrW6VqNpS6YHTTw3nNX1 ) users receive a firewall rule to provide protection against any exploits that may target this vulnerability.
June 29, 2023 – A partial patch is released in version 3.0.2.
July 4, 2023 – A fully patched version of the plugin, 3.0.2.1, is released.
July 20, 2023 – Wordfence Free users receive the same protection.
Conclusion
In this blog post, we detailed an Arbitrary File Upload vulnerability within the User Registration plugin affecting versions 3.0.2 and earlier. This vulnerability allows authenticated threat actors with subscriber-level permissions or higher to upload arbitrary files, including PHP backdoors, and execute those files on the server. The vulnerability has been fully addressed in version 3.0.2.1 of the plugin.
We encourage WordPress users to verify that their sites are updated to the latest patched version of User Registration.
Wordfence Premium (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYBqW8kzz6V2RVp1bW8lNwqB3W2523N36SL9TCPL1gW6KdN83576p_2W7dVzPc8mP_wWW4dfTrj5NSxjrN1nz4Z9Khfx_W15MZnh2xW2zYW3h3qkJ2Nx8h0W4SSjQ16hxP6tN6J3Mw1zrtsyW7Z-r3x4bwbDQV55q6f5TdzWVW3Q-qLY1pXDsZW68CVzT8tRKVgW6Z_Ly-8mrp5nW3WY24j9c0HJCW7kXqz85VTHqfW4v8WrY7bXfwvW33LZKT6ygg1k3nBs1 ) , Wordfence Care (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgzRcW7nRv0m5vcgCFW8M-2CS2VCJgwW4N9bFl8_f1WsN67YHSMSWWkrW4DR0ZG8TjjNvW7jKPvC17c8Q-W1x906X7SnRj3W8v5zPC8M6gjPN5mjFppTW5vhW49hfYZ2w6Kg1W6XV2r9972SkqW1s9bwz6Bh9jGW5wmhB24gRcZpW32fccZ8hWRbFVfd-Yx8J13CJV8d0nJ8N4KnjW13_CnS75wG5-W2Gyzjt8R7CPlW21PRg52kNP1jW3sQ_fx2673Xk3nTk1 ) , and Wordfence Response (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYD2W6YNQ96888-rfW9hpBMb7L4_30W6_tH-x3GpWHBW15Qd7V2ShpGVW7P3pCt36M600W95lysJ1TYwcMW4KrK7Y1y6mjDW31gVyQ88Vr-NN7Wqn_gjKTMtW6gF1403V1XVjW1sV-Jp7znzCMW7KNxcL34pq41W2k3YqL4VZt1bW70XtMf65ykJxW6BJNPl5q7s4FW3tFCyc4jqM3kW8JC3Zq5v_StBW5d-nJH1ZB0MgW2vJkTw4Bd9ZrW6VqNpS6YHTTw3nNX1 ) users received a firewall rule to protect against any exploits targeting this vulnerability on June 20, 2023. Sites still using the free version of Wordfence will receive the same protection on July 20, 2023.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
For security researchers looking to disclose vulnerabilities responsibly and obtain a CVE ID, you can submit your findings to Wordfence Intelligence (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLfZ3kWDwV1-WJV7CgYfWVMQw1f87TXmcW1rFB-s2JJ9-1W65SjRJ2LCQF4W5GsfL-6FPTzdW2jSpwt617qr2W8KdTMN4dQM6wW1F24gQ4N2XTYW777Xq68NklMVN7l_1M1d57v8W4T_Dsx90SCWLW1KPNzS5ms2FKW2r6NGQ68p0KnW2hhN4T93JqlCW73h00F8QpRqzW4QLYwR2YBTGmW3hbp0h6L6s7mW6Mxd1N1lr44RW97JSny4XDFRN39h71 ) and potentially earn a spot on our leaderboard (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgy3kWF5V1-WJV7CgCVXW8F9FjM3w9mlrVkXhmc8J_H4VW4vPV4m1jVk_kW4SXMMZ51104mW12c8fW6XLZK0N7zPcK8qlWydN5Ll7z2rcPdsVrjr6h9lyvkSW7CPYWT7-hZ0-W99PhxZ8g0SRMW7b7ZnM5X_JFrW4n-WNT1pF6H1W8n1Hlf1PJSCXW8jq9Q24W45cxW17YPxl631RphW5gGC9b7qlk1HW1NhhWW1Pymv9W45PDVG3gg9zYW7dCXw45d-Zk_W7P0j9J2zHgwPW1lWJwc4lSSnRW92MHj87Cxf2_3qh61 ) .
The Full Product Lineup:
wf-stacked-free-1 (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7Cg_1jVj_cfr3lWd9GW11D3013MwYVrW7SV7Gs4nzLHsW8WjlmY8fhS0WV5547z6zwxBjW4b-P-18VRY85W4xHkc65y5D4YV5pKz-7-jqpXW8lWSMX78vsFPW5RDfqf2L4KPqN49y-vk904q_W4s-V3R4dByLbW5DDnlN79fNKwN2fqcTrtGr2VW8XhCNj7CZqCsW8sD_8k4V6J-jW39l5N-64Ly-PW5ZxsXh7sFPH2W6wwkGv1HRp70W8FR-Lt8C41m62VY1 )
wf-stacked-premium-1 (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgGbHW1LlYw897sCmPW4WKxvP24w-tSW5dWjPH2sk8XcW6R8jf96FjnBTVN8hY_2v6Wk2W6079Yx610mF7W4Z8msq5yGGMNW3SHpyW980zdKW2Vhw-T5CrZLxW76hbjQ3STThbW6DHpwc79ntj2W1pqbkz851W79W4FfXD33ld1nfW6wvDBw6V2DFgW3W1PhZ2FsQg-W2xkD1f6TwCbxW81YVbQ7xn4cmW5fK_h13MbC9zW6_4hPc1czFw9W1JgYLG4p_4Xk3nj_1 )
wf-stacked-care-3 (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgCgjW6XQSlM1Lh8bpN8DyJvpHBD5fW1FTZNY8JNblrW5xTPmH6FTCzxW7LW8dN8mNdXfN8378RTLxHPlV4jj2r7gmgkZW770dx59h_G1PW8yPKZB7HnrrlW3xyHJp6HN-NtW1q_Fx74ZNM8WW5TLltn7Fw42cW8YMYmF5JmcbTN5Vdh_0k4mxSW64FYkN2yZ94YW4wk2Km5kktkVW61MFt93WCHw7VRv_pD2d7Lv9N7s-9Mn2LG9zW5g4hQZ8SnJvW3bQ61 )
wf-stacked-response-2 (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLgf3kWDQV1-WJV7CgYD2W6YNQ96888-rfW9hpBMb7L4_30W6_tH-x3GpWHBW15Qd7V2ShpGVW7P3pCt36M600W95lysJ1TYwcMW4KrK7Y1y6mjDW31gVyQ88Vr-NN7Wqn_gjKTMtW6gF1403V1XVjW1sV-Jp7znzCMW7KNxcL34pq41W2k3YqL4VZt1bW70XtMf65ykJxW6BJNPl5q7s4FW3tFCyc4jqM3kW8JC3Zq5v_StBW5d-nJH1ZB0MgW2vJkTw4Bd9ZrW6VqNpS6YHTTw3nNX1 )
wf-logo-intelligence-h-800 (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLfZ3kWDwV1-WJV7Cg-_9W4s71d-7CsX_HVVbd6Z3_bc_PW4SlXJ02YPjnnW676D6B6ySx6yW32Z25628BTSBW95vFd28KYDFhVL_VfR8Qll_CN5-HpngB5QHfW3vgQt83x5n_gW7Pr6298c7mY7W7CvqB-47nvzzW46G2rM8GXbzKVW95wG4sFkpnV349vT3fmJ7vW8TQGsN3-S6MdW22Jp2f28BrtNW2NcQXH7b-z7BW6ygZt07TL2Wc2-H1 )
logo-defiant (
https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VWq7--56W8tzW6Cmy5h53vZNSW89-nNw50VN-lN4-lLfG3kWDcV1-WJV7CgLj0N6N_1z9J-dJXW2hfjSv6hMbg8W4p6mj45731S2W87sHt14sHhKRN2ldZ3zgdDq6W2-R6j18yvcp8N238nts-YvjbN7BdHXhBXM9RW3t6RkF3MFpsXW6m2XhX2pxG-WW4M4db_2R0KHgVd9d306rfrWTW5yWmdB8bskNXVqLytb3jp_1LW2zk9pB21GQ3BN8xg30M6VrZm2Jx1 )
Defiant, Inc., 1700 Westlake Ave N STE 200, Seattle, WA 98109, United States
Unsubscribe (
https://email.wordfence.com/hs/manage-preferences/unsubscribe-all?languagePreference=en&d=Vn9bTK892TtnVsxx1M3JN_XyW41Rcn-4h29fmN6J4V3XmWFfPW9lj-hV6vsQBKV25vZ77mY7FNN9j9YyGWp_VGN7JvqgKXk_7QVbwc8g9fdy1zW6bT48s5h8Ll2n20LnH92w2&v=3&_hsenc=p2ANqtz-82oDePxh93awX52W9iZt5B8C2lNG2H7PZcnCy_WjnHz7w3DRLDOgJe6F40KqJlcP4ov2qsPax8gtlmaFbCqF0wW8JHyg&_hsmi=266023867 )
Manage preferences (
https://email.wordfence.com/hs/manage-preferences/unsubscribe?languagePreference=en&d=Vn9bTK892TtnVsxx1M3JN_XyW41Rcn-4h29fmN6J4V3XmWFfPW9lj-hV6vsQBKV25vZ77mY7FNN9j9YyGWp_VGN7JvqgKXk_7QVbwc8g9fdy1zW6bT48s5h8Ll2n20LnH92w2&v=3&_hsenc=p2ANqtz-82oDePxh93awX52W9iZt5B8C2lNG2H7PZcnCy_WjnHz7w3DRLDOgJe6F40KqJlcP4ov2qsPax8gtlmaFbCqF0wW8JHyg&_hsmi=266023867 )
You're receiving this email because you signed up to the Wordfence WordPress security mailing list.
Received on Wed Jul 12 2023 - 15:49:43 CEST