AMP for WP Vulnerability – Authenticated (Contributor+) Cross-Site Scripting via Shortcode – CVE-2023-6782 | WordPress Plugin Vulnerability Report

Q: What is the AMP for WP vulnerability?

What is the AMP for WP vulnerability? The vulnerability, tracked as CVE-2023-6782, affects versions of the AMP for WP plugin up to and including 1.0.92. It allows authenticated users with contributor access or higher to inject malicious scripts into pages that include the plugin's shortcodes. When visitors view affected pages, the scripts execute, enabling serious attacks like site takeovers or data theft.

Q: How can this vulnerability be exploited?

How can this vulnerability be exploited? Attackers would first need a way to gain contributor access to the vulnerable WordPress site. This could happen through compromised admin credentials or weak passwords. Once they can access the admin dashboard, they can add pages/posts with shortcodes and inject malicious scripts into parameters. They save the page and the scripts get stored. Now when users visit those pages, the scripts execute.

Q: What damage can be done through this vulnerability?

What damage can be done through this vulnerability? Full site takeovers are possible. Attackers can gain admin access, steal user data, install backdoors, conduct phishing attacks, deface sites, redirect visitors to malicious pages, and more. Essentially, they gain a foothold to then conduct any other attack they want by compromising the site.

Q: What WordPress sites are affected?

What WordPress sites are affected? Any site running the AMP for WP plugin at affected versions, up to and including 1.0.92, is vulnerable. This is a popular plugin with over 17 million downloads, so a widespread issue. If you have not updated recently, check your site's plugin versions immediately.

Q: Is there a patch available?

Is there a patch available? Yes, the plugin developers have issued a patched version 1.0.92.1 that resolves the vulnerability. All users should manually update to this latest version or enable automatic background updates if supported by your WordPress hosting provider.

Q: Should I switch AMP plugins entirely?

Should I switch AMP plugins entirely? The updated AMP for WP plugin is safe if you patch to 1.0.92.1 or higher. However, given the repeated vulnerabilities associated with this plugin, switching to an alternate AMP solution like Better AMP could provide more peace of mind regarding security.

Q: How do I know if my specific site was compromised?

How do I know if my specific site was compromised? Carefully check pages and posts with shortcodes for any unexpected or unfamiliar scripts, iframes, or code snippets. Also scan files for anything suspicious. Check when users were last active and whether any new unrecognized admin accounts exist. Unfortunately, complex attacks can be difficult to detect, so consider a managed website security provider to monitor for threats.

Q: Why do these vulnerabilities happen so often?

Why do these vulnerabilities happen so often? The rapid pace of software development can make it difficult to identify all possible vulnerabilities in advance. Hackers constantly probe apps for undiscovered flaws. Additionally, the complex integrations between various plugins, themes, and WordPress itself multiply the potential attack surface. More popular software simply gets probed more.

Q: How can I better stay on top of future vulnerabilities?

How can I better stay on top of future vulnerabilities? Subscribe to plugin developer mailing lists or security advisory services to receive notifications when new issues emerge. Schedule monthly plugin reviews and always update to latest versions. Consider managed WordPress security services that monitor 24/7 and automatically patch vulnerabilities. For busy site owners, outsourcing oversight is wise.

Q: What can software developers do to avoid these issues?

What can software developers do to avoid these issues? Integrating security reviews into the development process helps. Rigorous testing by ethical hackers who probe intentionally for flaws can reveal weaknesses missed otherwise. Following secure coding best practices through the entire lifecycle also reduces chances of vulnerabilities. But due to complexity, some bugs inevitably slip through which is why ongoing monitoring and quick patching is essential.

By Your WP Guy | December 18, 2023

Plugin Name: AMP for WP

Key Information:

Software Type: Plugin
Software Slug: accelerated-mobile-pages
Software Status: Active
Software Author: mohammed_kaludi
Software Downloads: 17,465,196
Active Installs: 100,000
Last Updated: December 18, 2023
Patched Versions: 1.0.92.1
Affected Versions: <= 1.0.92

Vulnerability Details:

Name: AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
Title: Authenticated (Contributor+) Cross-Site Scripting via Shortcode
Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE: CVE-2023-6782
CVSS Score: 6.4 (Medium)
Publicly Published: December 18, 2023
Researcher: Ngô Thiên An
Description: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Summary:

The AMP for WP plugin for WordPress has a vulnerability in versions up to and including 1.0.92 that allows for stored cross-site scripting by authenticated users with contributor-level access or higher. This vulnerability has been patched in version 1.0.92.1.

Detailed Overview:

This vulnerability allows attackers with contributor access or higher to store malicious scripts in pages that use the plugin's shortcodes. When victims visit a page containing the injected scripts, the scripts will execute. This could lead to session hijacking, site defacement, phishing attacks and more. The vulnerability was reported by researcher Ngô Thiên An and has been fixed by the plugin developers in version 1.0.92.1. All users should update immediately.

Advice for Users:

Immediate Action: Update to version 1.0.92.1 or higher immediately.
Check for Signs of Vulnerability: Review pages and posts for unexpected scripts or iframes.
Alternate Plugins: Consider alternate AMP plugins like Better AMP.
Stay Updated: Always keep plugins updated to avoid vulnerabilities.

Conclusion:

The update patches this serious vulnerability. Users should install version 1.0.92.1 immediately to prevent compromise of their sites. Prompt updates are key to staying secure.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/accelerated-mobile-pages

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/accelerated-mobile-pages/amp-for-wp-accelerated-mobile-pages-1092-authenticated-contributor-cross-site-scripting-via-shortcode

Detailed Report:

Have you updated your websites lately? Keeping your WordPress site and its plugins up-to-date is critical for security, as outdated software frequently contains vulnerabilities that hackers can exploit to compromise sites. Unfortunately, the popular AMP for WP plugin has a newly discovered vulnerability that underscores this risk.

What is AMP for WP?

AMP for WP is a widely-used plugin that helps optimize WordPress sites for fast loading on mobile devices. With over 17 million downloads and around 100,000 active installs, it's a popular choice to improve site speed.

Details on the New Vulnerability

Researchers recently disclosed a serious vulnerability in AMP for WP affecting versions up to and including 1.0.92. Tracked as CVE-2023-6782, the issue allows authenticated users with contributor-level access or higher to inject malicious scripts into pages that include the plugin's shortcodes. When visitors load vulnerable pages, the scripts execute, potentially enabling session hijacking, site defacement, or phishing.

Risks and Impacts

This vulnerability enables serious compromise of WordPress sites. Attackers could gain admin access, steal user data, deface sites, install backdoors, redirect visitors, and conduct phishing. Basically, it opens the door for attackers to take full control or conduct any other attack they desire.

How to Fix

Thankfully, the plugin developers have patched the issue in AMP for WP version 1.0.92.1. All users should update immediately to close the vulnerability on their sites. You can do this manually through the WordPress dashboard. If you need assistance updating or checking whether your specific site was compromised, don’t hesitate to get in touch.

Previous Vulnerabilities

Unfortunately, this is not the first vulnerability found in AMP for WP. There have been 5 previous issues reported since October 2018 that also enabled site takeovers until patched. This illustrates risks with outdated plugins.

The Importance of Staying Updated

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

AMP for WP Vulnerability - Authenticated (Contributor+) Cross-Site Scripting via Shortcode - CVE-2023-6782 | WordPress Plugin Vulnerability Report FAQs

What is the AMP for WP vulnerability?

The vulnerability, tracked as CVE-2023-6782, affects versions of the AMP for WP plugin up to and including 1.0.92. It allows authenticated users with contributor access or higher to inject malicious scripts into pages that include the plugin's shortcodes. When visitors view affected pages, the scripts execute, enabling serious attacks like site takeovers or data theft.

How can this vulnerability be exploited?

Attackers would first need a way to gain contributor access to the vulnerable WordPress site. This could happen through compromised admin credentials or weak passwords. Once they can access the admin dashboard, they can add pages/posts with shortcodes and inject malicious scripts into parameters. They save the page and the scripts get stored. Now when users visit those pages, the scripts execute.

What damage can be done through this vulnerability?

What WordPress sites are affected?

Is there a patch available?

Should I switch AMP plugins entirely?

How do I know if my specific site was compromised?

Carefully check pages and posts with shortcodes for any unexpected or unfamiliar scripts, iframes, or code snippets. Also scan files for anything suspicious. Check when users were last active and whether any new unrecognized admin accounts exist. Unfortunately, complex attacks can be difficult to detect, so consider a managed website security provider to monitor for threats.

Why do these vulnerabilities happen so often?

The rapid pace of software development can make it difficult to identify all possible vulnerabilities in advance. Hackers constantly probe apps for undiscovered flaws. Additionally, the complex integrations between various plugins, themes, and WordPress itself multiply the potential attack surface. More popular software simply gets probed more.

How can I better stay on top of future vulnerabilities?

Subscribe to plugin developer mailing lists or security advisory services to receive notifications when new issues emerge. Schedule monthly plugin reviews and always update to latest versions. Consider managed WordPress security services that monitor 24/7 and automatically patch vulnerabilities. For busy site owners, outsourcing oversight is wise.

What can software developers do to avoid these issues?

Integrating security reviews into the development process helps. Rigorous testing by ethical hackers who probe intentionally for flaws can reveal weaknesses missed otherwise. Following secure coding best practices through the entire lifecycle also reduces chances of vulnerabilities. But due to complexity, some bugs inevitably slip through which is why ongoing monitoring and quick patching is essential.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged AMP for WP, CVE-2023-6782, hacking, Plugins, Site Takeover, stay updated, Vulnerabilities, web performance, Web Security, website updates, wordpress security