WordPress Plugin Vulnerability Report – Solid Security – Unauthenticated Login Page Disclosure

Q: What exactly is the vulnerability in Solid Security?

What exactly is the vulnerability in Solid Security? The vulnerability is an unauthenticated login page disclosure flaw affecting versions up to 9.0.0. When comments are enabled and registration required on a site, Solid Security will reveal the path to the admin login page. This exposes the secret URL to attackers.

Q: How serious is this vulnerability?

How serious is this vulnerability? While not enabling direct access, it is considered a medium severity issue with a CVSS score of 5.3. Disclosing the login path weakens security protections that are meant to obscure the admin URL. This makes brute force and other attacks easier.

Q: Could this vulnerability let hackers break into my site?

Could this vulnerability let hackers break into my site? Not directly, but it gives attackers information to stage further attacks. Knowing where the admin login is located allows bad actors to concentrate efforts and launch password guessing and brute force attempts. If successful with those, full site takeover is possible.

Q: What versions of Solid Security are affected?

What versions of Solid Security are affected? All versions up to and including 9.0.0 are impacted. The issue has been patched in release 9.0.1, so sites running this latest version are safe. If on an older version, you should update immediately.

Q: What if I don't use comments or registration on my site?

What if I don't use comments or registration on my site? You may still be at risk, as other configurations and themes can trigger the behavior. To be safe, all users of Solid Security prior to 9.0.1 should apply the update.

Q: Are other plugins affected?

Are other plugins affected? No, this particular vulnerability is limited to Solid Security. However, vulnerabilities in other plugins are frequently disclosed, so keeping all plugins updated is a best practice.

Q: How can I tell if hackers have exploited this on my site?

How can I tell if hackers have exploited this on my site? Carefully review web server access logs for abnormal traffic and failed login attempts. Also check user accounts for any unauthorized changes. If compromised, wipe systems fully and restore from backup.

Q: Is there an alternate plugin I can use instead?

Is there an alternate plugin I can use instead? Popular alternatives like WordFence, iThemes Security, and All In One WP Security can provide similar protections. Evaluate options to determine the best fit.

Q: How can I prevent future vulnerabilities like this?

How can I prevent future vulnerabilities like this? Always use the latest plugin versions, avoid end-of-life releases, limit plugins when possible, and perform frequent security audits to identify issues before attackers do.

Q: I don't have time to stay on top of WordPress security. What should I do?

I don't have time to stay on top of WordPress security. What should I do? Consider hiring professionals to monitor and maintain the site's security. Managed WordPress hosting providers can also take care of many security tasks for you. Outsourcing security is wise if you lack expertise.

By Your WP Guy | October 31, 2023

Plugin Name: Solid Security

Key Information:

Software Type: Plugin
Software Slug: better-wp-security
Software Status: Active
Software Author: ithemes
Software Downloads: 28,594,364
Active Installs: 900,000
Last Updated: October 31, 2023
Patched Versions: 9.0.1
Affected Versions: <= 9.0.0

Vulnerability Details:

Name: Solid Security Basic <= 9.0.0 - Unauthenticated Login Page Disclosure
Title: Unauthenticated Login Page Disclosure
Type: Protection Mechanism Failure
CVSS Score: 5.3 (Medium)
Publicly Published: October 31, 2023
Researcher: Naveen Muthusamy
Description: The Solid Security – Password, Two Factor Authentication, and Brute Force Protection plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 9.0.0. This is due to the plugin disclosing the login path when comments are enabled and registration is required. This makes it possible for unauthenticated attackers to discover the login page path and bypass the intended functionality of the security mechanism.

Summary:

The Solid Security plugin for WordPress has a vulnerability in versions up to and including 9.0.0 that allows unauthenticated attackers to discover the login page path and bypass security protections. This vulnerability has been patched in version 9.0.1.

Detailed Overview:

The Solid Security plugin, which provides password protection, two-factor authentication, and brute force attack prevention for WordPress sites, is vulnerable to an unauthenticated login page disclosure flaw. Discovered by researcher Naveen Muthusamy, the issue arises when comments are enabled on the site and user registration is required. In this configuration, the plugin will reveal the login page path to unauthenticated users. This allows attackers to discover where the admin login page is located, enabling them to target brute force and other credential attacks. While no specific exploit is required, the failure to properly protect the login path represents a protection mechanism bypass. The vulnerability is considered medium severity with a CVSS score of 5.3. It affects all versions of the plugin up to and including 9.0.0. Users are advised to update to version 9.0.1, which resolves the disclosure problem by removing login path hints. There are no official reports of this vulnerability being exploited in the wild.

Advice for Users:

Immediate Action: Update to Solid Security version 9.0.1 as soon as possible.
Check for Signs of Vulnerability: Review web server access logs for any abnormal or suspicious login attempts. Also check for any changes to user accounts.
Alternate Plugins: Consider using an alternate security plugin like WordFence or iThemes Security as a precaution.
Stay Updated: Always keep plugins updated and avoid using plugin versions marked End of Life by developers.

Conclusion:

The timely response by the developers to patch this vulnerability shows their commitment to security. Users should install version 9.0.1 or higher to ensure their WordPress sites are not susceptible to this protection bypass issue. Proper plugin hygiene and update diligence continues to be critical for WordPress site security.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/better-wp-security

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/better-wp-security/solid-security-basic-900-unauthenticated-login-page-disclosure

Detailed Report:

Keeping your WordPress website and its plugins up-to-date is critical for security. Unfortunately, many users fail to properly maintain plugins, leaving their sites exposed to vulnerabilities. A recently disclosed flaw in the popular Solid Security plugin highlights this risk. Versions up to 9.0.0 contain a protection bypass bug that can allow attackers to discover your secret login page. While this doesn’t directly enable infiltration, it dismantles a key defense.

Developers have already issued a patch, but many users likely haven’t updated. We strongly advise installing the latest plugin release immediately to close this open door. For those concerned about the security posture of their website, our team of experts can perform an audit and determine what steps are needed to lock things down. Don't leave your site open to compromise - proper patching, vigilant monitoring, and help when you need it can keep you safe.

The Solid Security plugin, which provides password protection, two-factor authentication, and other security features, is used on over 900,000 WordPress sites. Unfortunately, a medium severity vulnerability was recently disclosed that affects all versions up to 9.0.0. When comments are enabled and registration required, the flawed plugin reveals the admin login URL to unauthenticated users. While not directly enabling access, this destroys a key safeguard.

Attackers could leverage the exposed login path to launch brute force attacks and attempt to crack admin passwords. If successful, they could gain privileged access and fully compromise the site. Beyond password attacks, the loss of obscurity around the login location damages the overall security posture.

The good news is that the developer has already patched the problem in version 9.0.1. Sites using this latest release are no longer affected. For those on older versions, you should update immediately to close this door. Be sure to also review web logs for any suspicious activity and watch for unauthorized changes to user accounts.

While this specific flaw has been addressed, Solid Security has been susceptible to over 15 vulnerabilities since 2012. This underscores the importance of proper plugin hygiene. Always use the latest versions, avoid end-of-life releases, and monitor closely for any new threats.

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.