Question 1

What exactly is the vulnerability in Advanced Database Cleaner?

Accepted Answer

What exactly is the vulnerability in Advanced Database Cleaner?

The vulnerability allows authenticated users with admin access to inject arbitrary PHP objects due to the improper handling of user input. Specifically, the 'process_bulk_action' function deserializes untrusted data without proper sanitization. This could enable serious impacts if a POP chain exists via other plugins.

Question 2

What versions of Advanced Database Cleaner are affected?

Accepted Answer

What versions of Advanced Database Cleaner are affected?

All versions up to and including 3.1.3 are affected. The vulnerability has been patched in version 3.1.4, released on January 24, 2024.

Question 3

What is the risk if my site is vulnerable?

Accepted Answer

What is the risk if my site is vulnerable?

If exploited, this vulnerability could allow attackers to delete files, steal sensitive database information, or even execute remote code on your site. The impacts depend on if a POP chain exists, but it should be treated as a critical risk.

Question 4

How can I tell if my site has already been compromised?

Accepted Answer

How can I tell if my site has already been compromised?

Carefully check logs for any suspicious activity. Also scan your site with a malware/virus detection tool to identify any compromised files or code. Watch for unexpected behavior like plugin settings changing.

Question 5

Should I remove Advanced Database Cleaner from my site?

Accepted Answer

Should I remove Advanced Database Cleaner from my site?

Not necessarily - the developers have patched the issue quickly. Upgrading to the latest secure version is recommended. However, consider installing an alternate database cleanup plugin as an extra precaution.

Question 6

What if I can't update the plugin right away?

Accepted Answer

What if I can't update the plugin right away?

Restrict admin access to trusted users only until you can update. Also consider setting up a web application firewall to help block potential attacks leveraging this specific vulnerability.

Question 7

Could updating cause any issues with my site?

Accepted Answer

Could updating cause any issues with my site?

Updating to a new version should not cause issues in most cases. However, it's wise to backup your site before updating just in case. Also test the updated plugin on a staging site if possible.

Question 8

What can I do to prevent future vulnerabilities?

Accepted Answer

What can I do to prevent future vulnerabilities?

Enabling automatic background updates for both WordPress core and any plugins is a great step. Also research the security and update frequency of plugins before installing them.

Question 9

Should I be concerned about other plugins having vulnerabilities?

Accepted Answer

Should I be concerned about other plugins having vulnerabilities?

Yes - vulnerabilities in popular WordPress plugins are unfortunately quite common. It's critical to keep all plugins updated and have a process to promptly patch security issues.

Question 10

Who discovered and reported this vulnerability?

Accepted Answer

Who discovered and reported this vulnerability?

This vulnerability was discovered and responsibly disclosed by researcher Richard Telleng on January 24, 2024 to allow developers time to patch it before public release.

rce

Advanced Database Cleaner Vulnerability – Authenticated(Administrator+) PHP Object Injection via process_bulk_action – CVE-2024-0668 | WordPress Plugin Vulnerability Report

WordPress Plugin Vulnerability Report – Backup Migration – Unauthenticated Remote Code Execution – CVE-2023-6553

WordPress Plugin Vulnerability Report – SiteOrigin Widgets Bundle – Authenticated (Admin+) Local File Inclusion – CVE-2023-6295

Recent Blog Posts

LiteSpeed Cache Vulnerability – Unauthenticated Sensitive Information Exposure via Log Files – CVE-2024-44000 | WordPress Plugin Vulnerability Report

Elementor Addon Elements Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters – CVE-2024-4401, CVE-2024-7122 | WordPress Plugin Vulnerability Report

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Vulnerability – Authenticated (Contributor+) Information Disclosure – CVE-2024-7418 | WordPress Plugin Vulnerability Report

Additional Resources

About Your WP Guy