WordPress websites that use the WP Affiliate Platform plugin (up to and including version 6.3.9) are at risk of becoming compromised due to a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists due to insufficient input sanitization and output escaping on several parameters, allowing logged-in attackers with administrator-level permissions or higher to inject malicious scripts into web pages. When other users access these injected pages, the attacker's code will be executed, potentially compromising the user's data and the website's security.

Vulnerability Description

Stored XSS vulnerabilities occur when a web application saves unescaped user input and regurgitates it on a web page without properly sanitizing it first. In this scenario, the WP Affiliate Platform plugin allows the attacker to inject code through several parameters, which are then rendered in the WordPress dashboard and executed by a user's browser.

Code Snippet

The following example demonstrates an attack by using the aff parameter to inject a script into the URL:

https://example.com/wordpress/wp-admin/admin.php?page=wp_affiliate_platform_menu&aff=%3Cscript%3Ealert(%27XSS%27)%3C/script%3E

Here, %3Cscript%3Ealert(%27XSS%27)%3C/script%3E is a URL-encoded version of <script>alert('XSS')</script>.

When other users access the injected page, their browsers will execute the malicious script, displaying an alert box with the text "XSS". While this particular example is harmless, an attacker could use similar techniques to steal user data or perform malicious actions on the administrator's behalf.

Exploit Details

To successfully exploit this vulnerability, an attacker must have valid login credentials and administrator-level permissions on the targeted WordPress site. However, it is essential to note that even if only a single administrator user is compromised, the entire website's security may be put at risk.

Mitigation and Remediation

The plugin's developers fixed this vulnerability in version 6.4.. To protect your WordPress site, please follow these steps:

1. Update the WP Affiliate Platform plugin to version 6.4. or higher. The latest version can be downloaded from the official WordPress plugin repository.
2. Check your site for signs of unauthorized access or unexpected behavior, particularly from administrator-level users.
3. Encourage all users, especially administrators, to use strong, unique passwords and enable two-factor authentication (2FA) on their accounts if available.

Conclusion

The WP Affiliate Platform plugin for WordPress (versions up to 6.3.9) contains a Stored XSS vulnerability that could result in code execution, data compromise, and manipulation of web pages. Ensuring that your website is running the most recent version of this plugin and encouraging strong security practices among users is crucial for maintaining a secure site.

References

- Original Advisory - WP Affiliate Platform
- CVE-2022-3897 in National Vulnerability Database
- WordPress Plugin Repository - WP Affiliate Platform

Timeline

Published on: 11/29/2022 21:15:00 UTC
Last modified on: 12/01/2022 19:17:00 UTC