WordPress Plugin Vulnerability Report – Widgets for Google Reviews – Authenticated (Editor+) Arbitrary File Upload – CVE-2023-48275

Q: What versions of Widgets for Google Reviews are affected?

What versions of Widgets for Google Reviews are affected? The vulnerable versions of the plugin are up to and including version 11.0.2. Any WordPress site running Widgets for Google Reviews at version 11.0.2 or lower contains the authenticated arbitrary file upload vulnerability which could enable remote code execution.

Q: How serious is this vulnerability?

How serious is this vulnerability? This arbitrary file upload flaw represents a serious security threat. While complex to exploit in most situations, if leveraged it grants attackers potential full control over vulnerable sites. They could install malware, steal sensitive data, or otherwise wreak havoc. The access required lowers likelihood, but eliminating any pathway for intrusion is vital.

Q: How can I tell if a hacker has exploited this on my site?

How can I tell if a hacker has exploited this on my site? Carefully check your file directories, backups, and hosting logs for any unexpected file changes or uploads around the date of public disclosure on November 22nd, 2023. Also scan your site for known malware and threats. If anything seems suspicious, take your site offline until resolved.

Q: I don't use Widgets for Google Reviews. Am I safe?

I don't use Widgets for Google Reviews. Am I safe? If you can confirm your WordPress site has never had Widgets for Google Reviews installed, you do not need to worry about this particular vulnerability at all. However, other plugins have flaws, so stay vigilant regarding updates for everything.

Q: What could happen if my site was compromised via this vulnerability?

What could happen if my site was compromised via this vulnerability? If exploited, this flaw grants remote access and code execution. Hackers could install cryptojacking malware quietly using resources, deploy spam, steal sensitive site or customer data, deliver malware to site visitors, and cause other types of damage.

Q: Why wasn't this vulnerability caught sooner by developers?

Why wasn't this vulnerability caught sooner by developers? It seems testing may have overlooked this vulnerability vector. However, now patched quickly, open disclosure of flaws allows more eyes ensuring security, rather than bugs lingering silently for potential exploit.

Q: I updated months ago. Am I safe or do I need 11.1?

I updated months ago. Am I safe or do I need 11.1? You must be running version 11.1 or higher, even if on a recent prior update. Versions up to and including 11.0.2 contain this vulnerability. Check your installed version for peace of mind.

Q: What else can I do besides updating Widgets for Google Reviews?

What else can I do besides updating Widgets for Google Reviews? Enable automated background updates for plugins and themes. Regularly check logs and files for changes. Consider limiting admin users. Install security plugins that scan for threats, block suspected requests, and provide other protection layers.

Q: Would switching plugins also resolve this vulnerability?

Would switching plugins also resolve this vulnerability? Yes, removing Widgets for Google Reviews entirely in favor of another reviews plugin that has not demonstrated such flaws will eliminate exposure to this particular uploaded files threat vector.

Q: Where can I get help securing my site if I lack expertise?

Where can I get help securing my site if I lack expertise? If you need an expert assessment or help hardening WordPress security, an increasing number of firms offer managed services and solutions tailored specifically to resource-constrained site owners. Let us know if you need any recommendations.

By Your WP Guy | November 22, 2023

Plugin Name: Widgets for Google Reviews

Key Information:

Software Type: Plugin
Software Slug: wp-reviews-plugin-for-google
Software Status: Active
Software Author: trustindex
Software Downloads: 4,619,317
Active Installs: 300,000
Last Updated: November 22, 2023
Patched Versions: 11.1
Affected Versions: <= 11.0.2

Vulnerability Details:

Name: Widgets for Google Reviews <= 11.0.2 - Authenticated (Editor+) Arbitrary File Upload
Title: Authenticated (Editor+) Arbitrary File Upload
Type: Unrestricted Upload of File with Dangerous Type
CVE: CVE-2023-48275
CVSS Score: 6.6 (Medium)
Publicly Published: November 22, 2023
Researcher: Rafie Muhammad
Description: The Widgets for Google Reviews plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/tabs/feature_request.php file in all versions up to, and including, 11.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This vulnerability may only be fully exploitable for RCE in unique scenarios where the server is overloaded and the unlink() is not triggered immediately following move_uploaded_file().

Summary:

The Widgets for Google Reviews plugin for WordPress has a vulnerability in versions up to and including 11.0.2 that allows authenticated users with Editor+ level access to upload arbitrary files, which could enable remote code execution in some scenarios. This vulnerability has been patched in version 11.1.

Detailed Overview:

The researcher Rafie Muhammad discovered a vulnerability in the feature_request.php file of the Widgets for Google Reviews plugin that allows authenticated users with Editor or higher level access to upload files of any type without restriction. This could enable attackers to upload and execute malicious scripts on vulnerable WordPress sites. While the vulnerability may only be exploitable for RCE in unique scenarios due to the unlink() function being called after file upload, it still represents a serious risk that has been addressed in version 11.1. Sites running Widgets for Google Reviews up to and including 11.0.2 should update immediately.

Advice for Users:

Immediate Action: Update to version 11.1 or higher to patch this vulnerability.
Check for Signs of Compromise: Review your file directory for unexpected files, scan for malware.
Alternate Plugins: Consider tested SEO plugins as a precaution.
Stay Updated: Enable automatic background updates for plugins to avoid future vulnerabilities.

Conclusion:

The developer response shows the need for rapid patching of disclosed vulnerabilities. Users should install version 11.1 to eliminate this authenticated arbitrary file upload risk.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-reviews-plugin-for-google

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-reviews-plugin-for-google/widgets-for-google-reviews-1102-authenticated-editor-arbitrary-file-upload

Detailed Report:

Keeping your WordPress website updated is crucial to protecting yourself against the latest security threats. This point has been underscored yet again with the recent disclosure of a serious authenticated arbitrary file upload vulnerability in the popular Widgets for Google Reviews plugin. This vulnerability enables editors and administrators on affected sites to upload malicious files, presenting a serious hacking risk. If you haven't updated recently, it's time to take action.

About the Vulnerable Plugin

Widgets for Google Reviews is a widely-used plugin with over 4.6 million downloads and 300,000 active installs. It allows site owners to easily display Google reviews. The plugin is developed by Trustindex and is actively maintained.

Technical Details of the Vulnerability

The vulnerability, now patched in version 11.1, affects Widgets for Google Reviews versions up to and including 11.0.2. It allows authenticated users with editor-level access or higher to upload files of any type without restriction due to missing server-side validation. This makes it possible to upload and execute malicious scripts. The vulnerability may allow full remote code execution in certain limited scenarios.

Impacts and Risks

This vulnerability allows attackers who have obtained editor access to a vulnerable site to remotely execute malicious code. They could steal data, install malware like cryptojackers to hijack site resources, or otherwise fully compromise the site. While exploitation may be complex, it's best to eliminate the risk.

What to Do: Updating Immediately

Sites running any version of Widgets for Google Reviews up to 11.0.2 should update to the latest secure version, 11.1, as soon as possible. Enabling automatic background updates for all plugins is also highly recommended. Review your files for unexpected uploads and scan for malware if you suspect exploitation.

The Bigger Picture: Staying Secure

This vulnerability underscores the importance of maintaining awareness and prompt updating of WordPress sites. As a small business owner without ample security resources, staying on top of threats can be difficult. But with some vigilance to enable notifications and automatic updates, the risks can be drastically reduced. Don't let outdated software put your livelihood at risk. If you ever have concerns about a compromise or questions about keeping your site safe, please reach out to our team of WordPress security experts for affordable solutions tailored to you.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.