WordPress Plugin Vulnerability Report – Paid Memberships Pro – Authenticated (Subscriber+) Arbitrary File Upload – CVE-2023-6187

Q: What exactly is the vulnerability in Paid Memberships Pro?

What exactly is the vulnerability in Paid Memberships Pro? The vulnerability is an arbitrary file upload issue that exists because of insufficient validation of uploaded file types in the plugin's code. This allows attackers to bypass restrictions on allowed files and upload anything they want to the site's server. This exposes sites to serious compromise if malicious files like web shells are uploaded.

Q: How severe is this vulnerability?

How severe is this vulnerability? This vulnerability is considered high severity with a CVSS score of 7.5. It allows attackers to potentially fully compromise vulnerable WordPress sites by uploading backdoor code or other malicious files. So it represents a very serious risk that required an immediate patch release by the plugin author once discovered.

Q: What versions of Paid Memberships Pro are affected?

What versions of Paid Memberships Pro are affected? The vulnerability impacts all versions up to and including 2.12.3. Sites running any of those versions should update to 2.12.4 as soon as possible in order to patch this critical arbitrary file upload flaw.

Q: Who could exploit this vulnerability?

Who could exploit this vulnerability? Any registered user role at or above Subscriber could potentially exploit this to upload malicious files. This includes customers who sign up for memberships. Attackers would just need a user account with those basic privileges to exploit the insufficient file validation.

Q: Does this affect all sites using Paid Memberships Pro?

Does this affect all sites using Paid Memberships Pro? The vulnerability only applies to sites that have PayPal Express or 2Checkout enabled as the payment gateway for memberships. It also requires having custom user profile fields enabled in the plugin. So not every configuration is automatically vulnerable, but many are.

Q: Could this vulnerability lead to a site being hacked?

Could this vulnerability lead to a site being hacked? Yes, the ability to upload any file to the server provides an initial foothold for attackers to fully compromise the site. Typical next steps would be uploading a web shell, giving the attacker remote access to execute additional code. So this vulnerability certainly enables serious site takeovers.

Q: Should I find an alternative to Paid Memberships Pro?

Should I find an alternative to Paid Memberships Pro? The vulnerability has been patched in the latest version, so Paid Memberships Pro can still be safely used. However, if you are concerned, there are alternative paid membership plugins like MemberPress that offer similar functionality. But the key is keeping your chosen plugin updated.

Q: What should I do if I think my site was compromised?

What should I do if I think my site was compromised? If you suspect your site was compromised through this vulnerability, take it offline immediately. You will then want to fully restore from backups before the attack occurred. It is also wise to scan for malware and change all passwords after restoring the site.

Q: How can I prevent vulnerabilities like this in the future?

How can I prevent vulnerabilities like this in the future? Unfortunately vulnerabilities are discovered regularly in WordPress plugins. So the best way to prevent issues is having a managed WordPress security service that keeps plugins patched, monitors for threats, and alerts you of any relevant issues.

Q: Why is keeping WordPress and plugins updated so important?

Why is keeping WordPress and plugins updated so important? The regular discovery of vulnerabilities like this illustrates why prompt updating is critical. Outdated plugins contain flaws that put sites at risk of compromise. So staying on top of updates is essential to lock down WordPress security and prevent attacks.

By Your WP Guy | November 16, 2023

Plugin Name: Paid Memberships Pro

Key Information:

Software Type: Plugin
Software Slug: paid-memberships-pro
Software Status: Active
Software Author: strangerstudios
Software Downloads: 5,334,391
Active Installs: 90,000
Last Updated: November 16, 2023
Patched Versions: 2.12.4
Affected Versions: <= 2.12.3

Vulnerability Details:

Name: Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload
Title: Authenticated (Subscriber+) Arbitrary File Upload
Type: Unrestricted Upload of File with Dangerous Type
CVE: CVE-2023-6187
CVSS Score: 7.5 (High)
Publicly Published: November 16, 2023
Researcher: István Márton
Description: The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads to insufficient file type validation in the 'pmpro_paypalexpress_session_vars_for_user_fields' function in versions up to, and including, 2.12.3. This makes it possible for authenticated attackers with subscriber privileges or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This can be exploited if 2Checkout (deprecated since version 2.6) or PayPal Express is set as the payment method and a custom user field is added that is only visible at profile, and not visible at checkout according to its settings.

Summary:

The Paid Memberships Pro for WordPress has a vulnerability in versions up to and including 2.12.3 that allows authenticated users with subscriber privileges or higher to upload arbitrary files. This vulnerability has been patched in version 2.12.4.

Detailed Overview:

The Paid Memberships Pro plugin for WordPress contains an arbitrary file upload vulnerability due to insufficient validation of uploaded file types in the 'pmpro_paypalexpress_session_vars_for_user_fields' function. This issue was reported by researcher István Márton and impacts Paid Memberships Pro versions up to and including 2.12.3.

The vulnerability allows authenticated users with subscriber privileges or higher to upload files of any type to the server by exploiting the lack of restrictions on allowed file types. This could enable remote code execution if malicious files are uploaded.

The issue is exploitable if the vulnerable Paid Memberships Pro configurations uses either 2Checkout or PayPal Express as the payment gateway, and has custom user profile fields enabled that are set to be visible at profile but not checkout.

This is a serious vulnerability that puts WordPress sites at risk of compromise. Paid Memberships Pro has high download counts, so many sites are likely affected.

Advice for Users:

Immediate Action: Update to Paid Memberships Pro version 2.12.4 as soon as possible.
Check for Signs of Vulnerability: Review your server logs for any unexpected file uploads by subscribers. Also scan files for anything suspicious.
Alternate Plugins: Consider using an alternate membership plugin like MemberPress as a precaution until you can fully update.
Stay Updated: Always keep your WordPress plugins updated to avoid vulnerabilities like this being exploited.

Conclusion:

The quick response by the Paid Memberships Pro developers to address this vulnerability is positive. Users should still treat this seriously and update as soon as possible. Running the latest plugin versions is critical to lock down WordPress sites against emerging threats.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/paid-memberships-pro

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/paid-memberships-pro/paid-memberships-pro-2123-authenticated-subscriber-arbitrary-file-upload

Detailed Report:

Keeping your WordPress website and its plugins up-to-date is critical for security. Unfortunately, too many site owners fail to regularly update and patch vulnerabilities that leave them exposed to attacks. This was demonstrated once again with the recent disclosure of a serious arbitrary file upload vulnerability in a popular WordPress membership plugin, Paid Memberships Pro.

Paid Memberships Pro is a widely used plugin with over 5 million downloads that allows site owners to offer premium content and features to paying members. However, versions up to and including 2.12.3 contain a vulnerability that allows authenticated users - like paying subscribers - to upload arbitrary files of any type to the site's server.

This vulnerability, now patched in version 2.12.4, is cause for concern given the large user base of over 90,000 active sites. It allows an attacker to potentially compromise a WordPress site by uploading malicious files, like a web shell, to enable further access and control.

The vulnerability exists because of insufficient validation of uploaded file types in the plugin's code. By exploiting this, an attacker can bypass restrictions on allowed files and upload anything. This is incredibly dangerous, especially since paying subscribers often have enhanced permissions compared to regular site visitors.

If your site is running Paid Memberships Pro, you should immediately update to version 2.12.4 to ensure you have the fix in place for this serious security flaw. Also be on the lookout for any unexpected files that may have been uploaded before you updated.

This is not the first vulnerability found in Paid Memberships Pro either - there have been 14 previous issues reported since November 2014. This highlights the ongoing importance of staying on top of updates and security notices, even for popular, well-established plugins.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.