Colibri Page Builder Vulnerability – Cross-Site Request Fogery – CVE-2024-1362, CVE-2024-1361 | WordPress Plugin Vulnerability Report

Q: Is my WordPress site at risk if I use Colibri Page Builder?

Is my WordPress site at risk if I use Colibri Page Builder? Your WordPress site is at risk if you use an outdated version of the Colibri Page Builder plugin, up to and including version 1.0.253. These vulnerable versions contain critical security flaws that could allow attackers to compromise administrator accounts, delete content, modify theme data, import images, or execute harmful code. Updating Colibri Page Builder to the latest patched version, 1.0.260, is highly recommended to secure your site.

Q: How do I know if my site is affected or has been compromised?

How do I know if my site is affected or has been compromised? Carefully check your installed version of Colibri Page Builder. If you have version 1.0.253 or below, you are affected and should upgrade immediately. Review your site’s logs and files for any suspicious activity involving Colibri Page Builder functions, unauthorized uploads or changes around the update timeline. If unsure, contact a security professional for forensic investigation.

Q: Should I find an alternate site builder plugin to be safe?

Should I find an alternate site builder plugin to be safe? While not strictly necessary since this vulnerability has been patched, you may consider alternate plugins like Elementor or Beaver Builder for building pages if you have heightened concerns. Always ensure any new and existing plugins are kept rigorously updated.

Q: What could happen if my site was compromised via these flaws?

What could happen if my site was compromised via these flaws? Attackers able to exploit these vulnerabilities could delete key content and files, import unwanted or malicious images, steal sensitive data like customer details, execute harmful code like cryptojackers, and force your site to distribute spam or malware. Compromised sites can seriously damage business reputations and bottom lines.

Q: Why wasn’t this vulnerability discovered during plugin testing?

Why wasn’t this vulnerability discovered during plugin testing? Even rigorous testing often cannot catch every vulnerability, especially complex issues like CSRF which require attackers actively manipulating requests. Once notified of these issues, Colibri Page Builder’s developers responded quickly to identify, patch and disclose them responsibly to protect users.

Q: Is updating enough or do I need to take other steps too?

Is updating enough or do I need to take other steps too? While a key first action, just updating Colibri Page Builder is not sufficient by itself. You should complete a comprehensive site audit to identify any other legacy issues, enable two-factor authentication for all admin accounts, install latest WordPress core and themes, disable inactive plugins, and consider a security plugin like Wordfence for deep scanning and firewall protection.

Q: What support does the plugin developer provide if I was hacked?

What support does the plugin developer provide if I was hacked? Unfortunately the Colibri Page Builder developer provides no direct user support services. If your site was compromised via this vulnerability before updating, you will need to pursue incident response and remediation independently via your web host, security providers or consultants. This underscores the importance of preventative measures like updates and backups.

Q: Can outdated plugins cause Google to flag my site as unsafe?

Can outdated plugins cause Google to flag my site as unsafe? Yes, if your site starts distributing malware or spam as a result of being compromised through a plugin exploit like this one, Google will detect this malicious activity and likely warn visitors via Chrome and blacklist the site in search results. Keeping all site software patched prevents the root danger.

Q: Should all plugins get regular security audits?

Should all plugins get regular security audits? Ideally, yes. All plugin code should undergo periodic audits by external experts to identify vulnerabilities before release and on major version upgrades. However not all plugin developers have sufficient resources for formal audits. Some rely on community bug reporting and reactive fixes when issues emerge post-launch. Users should prefer audited plugins when possible.

By Your WP Guy | February 22, 2024

Plugin Name: Colibri Page Builder

Key Information:

Software Type: Plugin
Software Slug: colibri-page-builder
Software Status: Active
Software Author: extendthemes
Software Downloads: 2,380,495
Active Installs: 100,000
Last Updated: February 22, 2024
Patched Versions: 1.0.260
Affected Versions: <= 1.0.253

Vulnerability Details:

Name: Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
Title: Cross-Site Request Fogery via cp_shortcode_refresh
Type: Cross-Site Request Forgery (CSRF)
CVE: CVE-2024-1362
CVSS Score: 4.3 (Medium)
Publicly Published: February 22, 2024
Researcher: Lucio Sá
Description: The Colibri Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.253. This is due to missing or incorrect nonce validation on the cp_shortcode_refresh() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Summary:

The Colibri Page Builder for WordPress has a vulnerability in versions up to and including 1.0.253 that allows unauthenticated attackers to execute arbitrary shortcodes or call some plugin functions via forged requests. This vulnerability has been patched in version 1.0.260.

Detailed Overview:

The Colibri Page Builder plugin did not correctly validate nonces (number used once) on the cp_shortcode_refresh() and apiCall() functions in versions up to and including 1.0.253. This makes it possible for attackers to forge requests to these functions without needing to be authenticated users. Via cp_shortcode_refresh(), attackers could potentially execute harmful shortcodes if they trick an administrator into clicking a link. Via apiCall(), attackers have access to import images, delete posts, or modify theme data. These vulnerabilities open sites using vulnerable versions of Colibri Page Builder to potential compromise.

These issues were reported by researcher Lucio Sá and have been patched by the developers in version 1.0.260, which was released on February 22, 2024. The vulnerabilities were assigned CVE-2024-1362 (cp_shortcode_refresh issue) and CVE-2024-1361 (apiCall issue).

Advice for Users:

Immediate Action: Update to version 1.0.260 or later to patch this vulnerability.
Check for Signs of Vulnerability: Review your site's logs for any suspicious activity involving the Colibri Page Builder plugin functions.
Alternate Plugins: Consider using alternate page builder plugins like Elementor or Beaver Builder if you have concerns.
Stay Updated: Always keep your WordPress plugins updated to the latest versions.

Conclusion:

These vulnerabilities found by Lucio Sá serve as an important reminder for developers to properly validate nonces and perform strict input sanitization on plugin functions. Users of the Colibri Page Builder plugin on WordPress sites should update as soon as possible to version 1.0.260 or later. Staying up-to-date with security patches is essential to securing WordPress sites against threats.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/colibri-page-builder

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/colibri-page-builder/colibri-page-builder-10253-cross-site-request-fogery-via-cp-shortcode-refresh

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/colibri-page-builder/colibri-page-builder-10253-cross-site-request-fogery-via-extend-builder

Detailed Report:

Keeping your WordPress website secure should be a top priority for any website owner. Unfortunately, vulnerabilities in plugins like the popular Colibri Page Builder are frequently discovered, putting over 100,000 sites using this plugin at risk if left unpatched. In versions up to and including 1.0.253, critical security issues have been found related to cross-site request forgery (CSRF) that allow attackers to potentially compromise administrator accounts or make harmful changes by tricking admins into clicking malicious links. Without urgent updates, sites using older versions of Colibri Page Builder could have content deleted, images imported without consent, or malicious code executed.

The Colibri Page Builder plugin did not correctly validate security tokens on key functions like cp_shortcode_refresh() and apiCall() in affected versions. This allows attackers to forge requests to execute actions in the plugin without needing an admin login. Via cp_shortcode_refresh(), hackers could run harmful shortcodes if an admin clicks a link. The apiCall() issue allows attackers access to import images, delete posts, and modify theme data without authorization.

These severe vulnerabilities open sites relying on outdated Colibri Page Builder versions to compromise of admin accounts, data loss, malware infections, and blacklisting by security services if exploited. It is essential sites update to version 1.0.260 to patch the vulnerabilities, which were reported by Lucio Sá and assigned CVE-2024-1362 and CVE-2024-1361. Version 1.0.260 was released by developers ExtendThemes on February 22, 2024 specifically to address these issues.

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Is my WordPress site at risk if I use Colibri Page Builder?

Your WordPress site is at risk if you use an outdated version of the Colibri Page Builder plugin, up to and including version 1.0.253. These vulnerable versions contain critical security flaws that could allow attackers to compromise administrator accounts, delete content, modify theme data, import images, or execute harmful code. Updating Colibri Page Builder to the latest patched version, 1.0.260, is highly recommended to secure your site.

How do I know if my site is affected or has been compromised?

Carefully check your installed version of Colibri Page Builder. If you have version 1.0.253 or below, you are affected and should upgrade immediately. Review your site’s logs and files for any suspicious activity involving Colibri Page Builder functions, unauthorized uploads or changes around the update timeline. If unsure, contact a security professional for forensic investigation.

Should I find an alternate site builder plugin to be safe?

What could happen if my site was compromised via these flaws?

Attackers able to exploit these vulnerabilities could delete key content and files, import unwanted or malicious images, steal sensitive data like customer details, execute harmful code like cryptojackers, and force your site to distribute spam or malware. Compromised sites can seriously damage business reputations and bottom lines.

Why wasn’t this vulnerability discovered during plugin testing?

Is updating enough or do I need to take other steps too?

While a key first action, just updating Colibri Page Builder is not sufficient by itself. You should complete a comprehensive site audit to identify any other legacy issues, enable two-factor authentication for all admin accounts, install latest WordPress core and themes, disable inactive plugins, and consider a security plugin like Wordfence for deep scanning and firewall protection.

What support does the plugin developer provide if I was hacked?

Unfortunately the Colibri Page Builder developer provides no direct user support services. If your site was compromised via this vulnerability before updating, you will need to pursue incident response and remediation independently via your web host, security providers or consultants. This underscores the importance of preventative measures like updates and backups.

Can outdated plugins cause Google to flag my site as unsafe?

Should all plugins get regular security audits?

Ideally, yes. All plugin code should undergo periodic audits by external experts to identify vulnerabilities before release and on major version upgrades. However not all plugin developers have sufficient resources for formal audits. Some rely on community bug reporting and reactive fixes when issues emerge post-launch. Users should prefer audited plugins when possible.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged Colibri Page Builder, Cross-Site Request Forgery, CSRF, Data Breach, exploit, ExtendThemes, hack, malware, Patch, Plugin, security, Update, vulnerability, Website Security, WordPress

Colibri Page Builder Vulnerability – Cross-Site Request Fogery – CVE-2024-1362, CVE-2024-1361 | WordPress Plugin Vulnerability Report

Plugin Name: Colibri Page Builder

Key Information:

Vulnerability Details:

Summary:

Detailed Overview:

Advice for Users:

Conclusion:

References:

Detailed Report:

Is my WordPress site at risk if I use Colibri Page Builder?

Is my WordPress site at risk if I use Colibri Page Builder?

How do I know if my site is affected or has been compromised?

How do I know if my site is affected or has been compromised?

Should I find an alternate site builder plugin to be safe?

Should I find an alternate site builder plugin to be safe?

What could happen if my site was compromised via these flaws?

What could happen if my site was compromised via these flaws?

Why wasn’t this vulnerability discovered during plugin testing?

Why wasn’t this vulnerability discovered during plugin testing?

Is updating enough or do I need to take other steps too?

Is updating enough or do I need to take other steps too?

What support does the plugin developer provide if I was hacked?

What support does the plugin developer provide if I was hacked?

Can outdated plugins cause Google to flag my site as unsafe?

Can outdated plugins cause Google to flag my site as unsafe?

Should all plugins get regular security audits?

Should all plugins get regular security audits?

Share this post:

Leave a Comment Cancel Reply

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings – CVE-2024-5583 | WordPress Plugin Vulnerability Report

LiteSpeed Cache Vulnerability – Unauthenticated Privilege Escalation – CVE-2024-28000 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy