Mollie Payments for WooCommerce Vulnerability – Unauthenticated Full Path Disclosure – CVE-2024-6448 | WordPress Plugin Vulnerability Report

Plugin Name: Mollie Payments for WooCommerce

Key Information:

• Software Type: Plugin
• Software Slug: mollie-payments-for-woocommerce
• Software Status: Active
• Software Author: mollieintegration
• Software Downloads: 3,421,407
• Active Installs: 100,000
• Last Updated: August 27, 2024
• Patched Versions: 7.8.0
• Affected Versions: <= 7.7.0

Vulnerability Details:

• Name: Mollie Payments for WooCommerce <= 7.7.0
• Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• CVE: CVE-2024-6448
• CVSS Score: 5.3
• Publicly Published: August 27, 2024
• Researcher: stealthcopter
• Description: The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to error reporting being enabled by default in multiple plugin files, which allows unauthenticated attackers to obtain the full path to instances. This information, though limited on its own, can be used in combination with other vulnerabilities or to aid in reconnaissance.

Summary:

The Mollie Payments for WooCommerce plugin for WordPress has a vulnerability in versions up to and including 7.7.0 that allows unauthenticated attackers to obtain full path disclosures due to error reporting being enabled by default. This vulnerability has been patched in version 7.8.0.

Detailed Overview:

The vulnerability was discovered by the researcher "stealthcopter" and involves the Mollie Payments for WooCommerce plugin exposing full paths to unauthenticated users. The error reporting is enabled by default in several plugin files, which could allow malicious actors to gather information about the file structure of the WordPress instance. While the exposed information is of limited use by itself, it could be used in combination with other exploits to cause more serious harm. For instance, attackers could use this information to simplify reconnaissance efforts, enabling them to locate vulnerable files and directories more easily.

The risk of this vulnerability is moderate, with a CVSS score of 5.3, as it can potentially lead to further exploitation. However, on its own, this issue does not compromise data integrity or availability, and it does not directly provide control over the affected system.

To resolve this issue, users are advised to update to the patched version (7.8.0), where the error reporting problem has been fixed.

Advice for Users:

• Immediate Action: Users are strongly encouraged to update their Mollie Payments for WooCommerce plugin to version 7.8.0 or later to prevent exposure to this vulnerability.
• Check for Signs of Vulnerability: To check if your site has been compromised, review your error logs and monitor for any unusual requests that may indicate reconnaissance attempts or the use of full path disclosures by attackers.
• Alternate Plugins: While a patch is available, users might still consider alternative payment plugins that offer similar functionality if they want to mitigate risk further.
• Stay Updated: Always ensure that your WordPress plugins are updated to the latest versions to minimize exposure to vulnerabilities. Regular updates are crucial in keeping your website secure.

Conclusion:

The prompt response from the Mollie Payments for WooCommerce developers to patch this vulnerability underscores the importance of timely updates. Users are advised to ensure that they are running version 7.8.0 or later to secure their WordPress installations and avoid potential exploitation.

References:

• Wordfence Threat Intelligence
• Wordfence Blog

Detailed Report: 

Keeping your website up to date is one of the most important steps you can take to protect it from security vulnerabilities. Unfortunately, many small business owners may not have the time to stay on top of security issues, which can leave their websites exposed. Recently, a vulnerability was discovered in the widely-used Mollie Payments for WooCommerce plugin, which affects all versions up to and including 7.7.0. This vulnerability, known as Unauthenticated Full Path Disclosure (CVE-2024-6448), could allow malicious actors to gather sensitive information about the file structure of your WordPress site, potentially opening the door to further attacks.

If you’re unsure about your website’s security or whether your site has been compromised, I’m here to help guide you through securing your site and taking action to protect your business.

Plugin Overview:

The Mollie Payments for WooCommerce plugin is a popular tool that enables WordPress site owners to accept various forms of online payments. With over 3.4 million downloads and 100,000 active installations, it is widely used by e-commerce sites of all sizes. The plugin was last updated on August 27, 2024, with the release of version 7.8.0, which includes a patch for the security vulnerability in question.

Vulnerability Details:

The vulnerability occurs because error reporting is enabled by default in several plugin files. This flaw allows unauthenticated attackers to expose the full path of files within the website’s server. While this information may seem harmless, it can be exploited in combination with other vulnerabilities to allow attackers to gather information about your website’s structure and potentially compromise your system.

Risks and Potential Impacts:

Though the CVSS score of 5.3 indicates that this vulnerability has moderate severity, it poses a significant risk when exploited alongside other vulnerabilities. Attackers can use the disclosed file paths to perform reconnaissance, enabling them to target specific files or directories for further exploitation. The exposure of such information may also simplify other types of attacks, such as SQL injection or remote file inclusion, by making it easier for attackers to locate the vulnerable components of your site.

Remediation:

Thankfully, this vulnerability has been addressed in version 7.8.0 of the plugin. Here are the steps you should take to secure your website:

1. Immediate Action: If you're using Mollie Payments for WooCommerce, update the plugin to version 7.8.0 or later immediately. This patch disables the error reporting feature that caused the vulnerability.
2. Check for Signs of Compromise: Review your error logs and monitor for any unusual activity or requests that might indicate a reconnaissance attempt. This could be a sign that someone has exploited the vulnerability on your site.
3. Alternative Plugins: While a patch is available, you might still consider alternative payment plugins that offer similar functionality, especially if you want to mitigate future risks. Some popular alternatives include Stripe for WooCommerce or WooCommerce Payments.
4. Stay Updated: Always make sure your plugins are updated to their latest versions. Many vulnerabilities are discovered after a plugin has already been in use for a long time, so staying current is crucial to protecting your site from potential attacks.

Previous Vulnerabilities:

It’s important to note that this is not the first time Mollie Payments for WooCommerce has experienced a security issue. Since November 27, 2023, there have been two previous vulnerabilities reported in the plugin, both of which were addressed in timely updates. This underscores the need for vigilance when using third-party plugins, as even trusted software can be prone to vulnerabilities over time.

Conclusion:

Staying on top of security vulnerabilities can be a daunting task, especially for small business owners with limited time to devote to website management. However, the recent Unauthenticated Full Path Disclosure vulnerability in Mollie Payments for WooCommerce is a reminder of just how important it is to keep your plugins updated to avoid exposing your business to unnecessary risks. If you’re concerned about your website’s security, reach out for assistance. Keeping your WordPress installation secure with timely updates and proactive monitoring is essential for maintaining the trust of your customers and the safety of your online operations.

By taking these simple steps, you can significantly reduce the chances of your site being compromised, and ensure your business remains secure in an increasingly digital world.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.