WordPress Plugin Vulnerability Report – News & Blog Designer Pack – Unauthenticated Remote Code Execution via Local File Inclusion – CVE-2023-5815

Q: What exactly is the vulnerability in the News & Blog Designer Pack plugin?

What exactly is the vulnerability in the News & Blog Designer Pack plugin? The vulnerability is a critical remote code execution flaw impacting versions up to and including 3.4.1 of the News & Blog Designer Pack plugin. By sending specially crafted requests to the bdp_get_more_post AJAX hook, unauthenticated attackers can achieve arbitrary PHP code execution on vulnerable WordPress sites. This is made possible because the plugin improperly extracts data from POST requests and passes it unsafely to include() statements. So by exploiting this, attackers could run malicious PHP code and takeover sites.

Q: How severe is this vulnerability?

How severe is this vulnerability? This is considered a critical severity vulnerability, with a CVSS score of 8.1 out of 10. The ease of exploiting it without needing any authentication makes it particularly dangerous. Remote code execution flaws that lead to total site compromise are about as serious as it gets for web security threats. This underscored how important it is to patch quickly.

Q: What versions of the plugin are affected?

What versions of the plugin are affected? All versions up to and including 3.4.1 are impacted by this vulnerability. Users should update to version 3.4.2 as soon as possible to mitigate this flaw. Any sites running an affected version are at risk.

Q: What could happen if my site was compromised via this vulnerability?

What could happen if my site was compromised via this vulnerability? A number of bad things could happen if your WordPress site was hacked via this vulnerability. Attackers could gain access to your whole database, stealing customer information like emails or passwords. They could deface your site with unwanted content. Or they could use your site as a jumping off point to conduct further attacks on your visitors. Complete compromise via remote code execution gives hackers a lot of control.

Q: How urgent is it to update this plugin?

How urgent is it to update this plugin? This update should be treated as extremely urgent. Remote code execution vulnerabilities lead to the worst impact, so leaving this unpatched puts sites at substantial risk. All users should upgrade immediately to protect their WordPress installations. Given how easily exploitable this is, attacks could come at any time.

Q: What steps can I take if I think my site was already hacked?

What steps can I take if I think my site was already hacked? If you suspect your site may have already been compromised via this vulnerability, take these steps: 1) Immediately update to the latest version of the plugin to mitigate further damage 2) Change all WordPress passwords, including admin and FTP 3) Scan for malware like backdoors that may have been installed 4) Review logs closely for signs of compromise 5) Consider restoring from a known clean backup.

Q: Are other plugins at risk too?

Are other plugins at risk too? While this specific vulnerability only impacts the News & Blog Designer Pack plugin, in general other plugins can also contain dangerous flaws. It's important to always keep WordPress and all plugins updated to the latest versions. Enabling automatic updates helps streamline this process. Being aware of newly disclosed exploits also allows you to proactively respond.

Q: How can I prevent my site being hacked in the future?

How can I prevent my site being hacked in the future? Some tips to better secure your WordPress site going forward include: Always run the latest versions of WordPress core, themes and plugins, Use strong passwords, Limit user roles and permissions, Install a web application firewall to block attacks, Perform frequent backups, Limit incoming traffic to admin pages, and Work with a managed security provider.

Q: What security solutions do you recommend for WordPress sites?

What security solutions do you recommend for WordPress sites? For the best WordPress security, we recommend taking a layered approach: Use a secure managed hosting provider specialized in WordPress, Install a WAF like Wordfence Threat Defense, Employ a plugin like iThemes Security to lock things down, Conduct regular vulnerability scanning, and Work with a managed security service to monitor and respond to threats.

Q: I don't have time to manage security - what should I do?

I don't have time to manage security - what should I do? If you don't have time as a small business owner to stay on top of all the latest threats and security maintenance, partnering with a managed security provider like Your WP Guy is the best approach. We can fully manage your WordPress security, respond to incidents, and give you peace of mind while you focus on your business. Relying on security experts is the most reliable way to defend against complex threats.

By Your WP Guy | October 26, 2023

Plugin Name: News & Blog Designer Pack

Key Information:

Software Type: Plugin
Software Slug: blog-designer-pack
Software Status: Active
Software Author: infornweb
Software Downloads: 408,098
Active Installs: 30,000
Last Updated: October 26, 2023
Patched Versions: 3.4.2
Affected Versions: <=3.4.1

Vulnerability Details:

Name: News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion
Title: Unauthenticated Remote Code Execution via Local File Inclusion
Type: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CVE: CVE-2023-5815
CVSS Score: 8.1 (High)
Publicly Published: October 26, 2023
Researcher: Florian Hauser
Description: The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.

Summary:

The News & Blog Designer Pack for WordPress has a vulnerability in versions up to and including 3.4.1 that allows unauthenticated remote code execution via local file inclusion. This vulnerability has been patched in version 3.4.2.

Detailed Overview:

Security researcher Florian Hauser disclosed an unauthenticated remote code execution vulnerability in the News & Blog Designer Pack WordPress plugin affecting versions up to and including 3.4.1. The vulnerability allows attackers to achieve arbitrary code execution via local file inclusion by targeting the bdp_get_more_post AJAX hook. This is made possible due to the hook using unsafe extraction from POST variables and passing them directly to include() statements. On misconfigured Docker environments, attackers could potentially write files that are then included. This represents a critical vulnerability that allows takeover of vulnerable WordPress sites.

There have been 3 previous vulnerabilities in this plugin since March 2022, indicating ongoing security issues.

Advice for Users:

Immediate Action: Upgrade to version 3.4.2 or higher immediately.
Check for Signs of Vulnerability: Review logs for any suspicious failed requests targeting the bdp_get_more_post AJAX action.
Alternate Plugins: Consider alternate plugins like WP Post Grid and Post Slider that offer similar functionality.
Stay Updated: Always keep plugins updated and review changelogs to identify security fixes.

Conclusion:

This critical vulnerability underscores the importance of keeping WordPress and plugins updated. Users should upgrade to the latest patched version of News & Blog Designer Pack to mitigate this vulnerability.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blog-designer-pack

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/blog-designer-pack/news-blog-designer-pack-wordpress-blog-plugin-341-unauthenticated-remote-code-execution

Detailed Report:

Keeping your WordPress website and its plugins updated is critical to maintaining security online. An alarming new vulnerability disclosed this week in a popular blogging plugin demonstrates precisely why. The News & Blog Designer Pack plugin, installed on over 30,000 sites, contains a critical remote code execution flaw allowing takeover of vulnerable WordPress installations. By exploiting this vulnerability, attackers could fully compromise sites running outdated versions of the plugin, underscored by the high severity CVSS score of 8.1. If you use this plugin, now is the time to take action by updating immediately. For anyone concerned about their website's security, we are here to help assess your risk and implement solutions to lock things down. Staying informed and proactive are key to avoiding threats like this dangerous vulnerability.

The News & Blog Designer Pack plugin is a popular tool for building customized blog layouts in WordPress. With over 400,000 downloads and 30,000 active installs, it powers blogs across a range of sites. Unfortunately, this widely-used plugin contains a severe vulnerability impacting all versions up to and including 3.4.1.

Security researcher Florian Hauser disclosed an unauthenticated remote code execution flaw that allows takeover of vulnerable WordPress sites. By sending crafted requests to the bdp_get_more_post AJAX hook, attackers can achieve arbitrary PHP code execution via local file inclusion. This is possible because the plugin improperly extracts POST data and passes it to include() statements. On misconfigured Docker sites, attackers could even write files that are subsequently included.

This vulnerability allows for complete site takeover, exposing customer data, defacing sites, and conducting further attacks. The ease of exploiting it without any authentication underscores the critical risk it poses. There have been 3 previous vulnerabilities in the plugin since March 2022 as well, pointing to ongoing security issues.

To mitigate this vulnerability, users should update to version 3.4.2 or higher immediately. It's also important to monitor logs for any suspicious requests related to it. For enhanced security, switching to alternate blogging plugins like WP Post Grid can be considered.

This case highlights why staying on top of plugin security is so important. But for busy small business owners running on WordPress, it can be challenging to stay updated. Working with a managed security provider is the best way to ensure vulnerabilities like this don't put your business at risk. They can monitor for threats, keep software patched and configured securely, and respond to incidents. Don't let your website be the next compromised by a dangerous exploit. Partnering with security experts lets you focus on your business, not cybersecurity.

Staying informed and being proactive are the keys to protecting your online presence. Vulnerabilities like this emerge frequently, but with the right solutions in place, small businesses can defend against threats targeting their websites.

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WordPress Plugin Vulnerability Report – News & Blog Designer Pack – Unauthenticated Remote Code Execution via Local File Inclusion – CVE-2023-5815 FAQs

What exactly is the vulnerability in the News & Blog Designer Pack plugin?

The vulnerability is a critical remote code execution flaw impacting versions up to and including 3.4.1 of the News & Blog Designer Pack plugin. By sending specially crafted requests to the bdp_get_more_post AJAX hook, unauthenticated attackers can achieve arbitrary PHP code execution on vulnerable WordPress sites. This is made possible because the plugin improperly extracts data from POST requests and passes it unsafely to include() statements. So by exploiting this, attackers could run malicious PHP code and takeover sites.

How severe is this vulnerability?

This is considered a critical severity vulnerability, with a CVSS score of 8.1 out of 10. The ease of exploiting it without needing any authentication makes it particularly dangerous. Remote code execution flaws that lead to total site compromise are about as serious as it gets for web security threats. This underscored how important it is to patch quickly.

What versions of the plugin are affected?

What could happen if my site was compromised via this vulnerability?

A number of bad things could happen if your WordPress site was hacked via this vulnerability. Attackers could gain access to your whole database, stealing customer information like emails or passwords. They could deface your site with unwanted content. Or they could use your site as a jumping off point to conduct further attacks on your visitors. Complete compromise via remote code execution gives hackers a lot of control.

How urgent is it to update this plugin?

What steps can I take if I think my site was already hacked?

If you suspect your site may have already been compromised via this vulnerability, take these steps: 1) Immediately update to the latest version of the plugin to mitigate further damage 2) Change all WordPress passwords, including admin and FTP 3) Scan for malware like backdoors that may have been installed 4) Review logs closely for signs of compromise 5) Consider restoring from a known clean backup.

Are other plugins at risk too?

While this specific vulnerability only impacts the News & Blog Designer Pack plugin, in general other plugins can also contain dangerous flaws. It's important to always keep WordPress and all plugins updated to the latest versions. Enabling automatic updates helps streamline this process. Being aware of newly disclosed exploits also allows you to proactively respond.

How can I prevent my site being hacked in the future?

Some tips to better secure your WordPress site going forward include: Always run the latest versions of WordPress core, themes and plugins, Use strong passwords, Limit user roles and permissions, Install a web application firewall to block attacks, Perform frequent backups, Limit incoming traffic to admin pages, and Work with a managed security provider.

What security solutions do you recommend for WordPress sites?

For the best WordPress security, we recommend taking a layered approach: Use a secure managed hosting provider specialized in WordPress, Install a WAF like Wordfence Threat Defense, Employ a plugin like iThemes Security to lock things down, Conduct regular vulnerability scanning, and Work with a managed security service to monitor and respond to threats.

I don't have time to manage security - what should I do?

If you don't have time as a small business owner to stay on top of all the latest threats and security maintenance, partnering with a managed security provider like Your WP Guy is the best approach. We can fully manage your WordPress security, respond to incidents, and give you peace of mind while you focus on your business. Relying on security experts is the most reliable way to defend against complex threats.

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged blog designer pack, news blog designer pack, Plugins, remote code execution, security, updates, Vulnerabilities, Web Security, Website Maintenance, WordPress