WordPress Plugin Vulnerability Report – WP Customer Reviews – Authenticated (Subscriber+) Sensitive Information Exposure – CVE-2023-4686

Q: What exactly is the vulnerability in WP Customer Reviews?

What exactly is the vulnerability in WP Customer Reviews? The vulnerability, discovered by researcher Marco Wotschka, is a missing authorization issue affecting versions up to and including 3.6.8 of WP Customer Reviews. Specifically, the ajax_enabled_posts function allows authenticated users, even just subscribers, to access and extract sensitive information. This includes unpublished post titles, slugs, and details about protected or trashed content. By exposing non-public data, the vulnerability enables privilege escalation, information disclosure, and further potential attacks.

Q: How serious is this vulnerability?

How serious is this vulnerability? With a CVSS severity score of 4.3 out of 10, this vulnerability is considered medium risk. However, it still poses a substantial threat given the wide user base of the plugin. Tens of thousands of WordPress sites are impacted, so the vulnerability could lead to widespread comment spam, phishing campaigns, malware distribution, SEO sabotage, and other attacks leveraging extracted information. Hackers could scrape customer email addresses for spam, publish unreleased content, and more.

Q: I use WP Customer Reviews. What should I do?

I use WP Customer Reviews. What should I do? Since no official patch is available yet, you should strongly consider deactivating or uninstalling WP Customer Reviews for the time being. While inconvenient, this is the only way to fully eliminate the information disclosure risk. You can use alternate plugins like Yotpo or WP Reviews in the interim. Be sure to monitor the WP Customer Reviews changelog and reactivate when the developer releases a fixed version.

Q: How can I tell if my site was compromised?

How can I tell if my site was compromised? Carefully review your content, logs, and user activity for any unauthorized changes or access. Signs of compromise could include new users or posts, modified/deleted content, spammy comments, changes to SEO titles/meta, and sudden traffic spikes. You may need to restore from a recent backup if significant alterations occurred. Run a security plugin scan for backdoors or malware.

Q: Are other plugins affected?

Are other plugins affected? This specific vulnerability only impacts WP Customer Reviews. However, vulnerabilities are discovered frequently in WordPress plugins. Being diligent about updates for all plugins is critical, as flawed plugins become easy vectors for attacks. Limit plugins to those absolutely necessary, maintain strong permissions, and enable update notifications.

Q: Why wasn’t this caught sooner?

Why wasn’t this caught sooner? While concerning, it is not entirely surprising for vulnerabilities to be missed during development and only discovered later. The key is the vendor response once notified - in this case, the developers have not yet issued a patch. Public disclosure pressures them to fix the flaw. Proper auditing and bug bounties would improve initial security.

Q: Is WordPress itself safe?

Is WordPress itself safe? In general, the WordPress core is secure when kept updated. The larger risks come from themes, plugins, weak passwords, and poor configurations. So while WordPress itself has a strong track record, you must be vigilant about the whole site’s security - not just the content management system.

Q: What about my hosted WordPress site?

What about my hosted WordPress site? Shared hosting platforms may automatically update WordPress itself. But you are still responsible for managing plugins, themes, and security settings. Do not rely on the host alone. Take ownership of the full site’s security, backup regularly, and control access. The host likely will not monitor or address plugin flaws.

Q: Are plugin vulnerabilities happening more often?

Are plugin vulnerabilities happening more often? Due to WordPress' popularity, plugins have become a prime target. Flaws are disclosed more frequently, but the raw number remains small compared to plugins available. With proper vetting and limiting plugins, the risk stays manageable. Automated security scans help spot issues early.

Q: How can I stay on top of WordPress security?

How can I stay on top of WordPress security? Subscribe to plugin update notifications, official WordPress security notices, and community sites detailing new threats. Test updates quickly when available. Limit, vet and monitor all plugins. Use automated vulnerability scanners. Backup frequently. And enable two-factor authentication for all user accounts on your site.

By Your WP Guy | October 31, 2023

Plugin Name: WP Customer Reviews

Key Information:

Software Type: Plugin
Software Slug: wp-customer-reviews
Software Status: Active
Software Author: bompus
Software Downloads: 1,108,443
Active Installs: 30,000
Last Updated: October 31, 2023
Patched Versions: No Patched Version
Affected Versions: <= 3.6.8

Vulnerability Details:

Name: WP Customer Reviews <= 3.6.8 - Authenticated (Subscriber+) Sensitive Information Exposure
Title: Authenticated (Subscriber+) Sensitive Information Exposure
Type: Missing Authorization
CVE: CVE-2023-4686
CVSS Score: 4.3 (Medium)
Publicly Published: October 31, 2023
Researcher: Marco Wotschka
Description: The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.8 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.

Summary:

The WP Customer Reviews plugin for WordPress has a vulnerability in versions up to and including 3.6.8 that allows authenticated users to access sensitive information via the ajax_enabled_posts function. This vulnerability has not yet been patched.

Detailed Overview:

Researcher Marco Wotschka discovered a missing authorization vulnerability in the WP Customer Reviews plugin that affects versions up to and including 3.6.8. The ajax_enabled_posts function allows authenticated users, including those with just subscriber access, to extract sensitive information such as post titles, slugs, and details about protected, trashed, or unpublished posts. This exposes private data that could be leveraged for further attacks. The vulnerability has a CVSS score of 4.3 (Medium severity). At the time of publishing, no patch is available from the plugin developers to address this issue.

Advice for Users:

Immediate Action: There is no patched version available at this time. Users should consider deactivating or uninstalling WP Customer Reviews until an update is released.
Check for Signs of Compromise: Review your WordPress content and logs for any unauthorized changes or access.
Alternate Plugins: Consider alternative customer review plugins like Yotpo, WP Reviews, or Google Reviews Widget until this vulnerability is resolved.
Stay Updated: Monitor the WP Customer Reviews changelog for new releases and update as soon as a fixed version is published.

Conclusion:

This vulnerability in a widely used WordPress plugin underscores the importance of keeping software updated. WP Customer Reviews users should take steps to secure their sites until an official patch is released.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-customer-reviews

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-customer-reviews/wp-customer-reviews-368-authenticated-subscriber-sensitive-information-exposure

Detailed Report:

Keeping your WordPress website secure requires constant vigilance - from using strong passwords to limiting plugins. Unfortunately, even if you do everything right, vulnerabilities in popular plugins can put your site at risk.

That’s why it’s critical to stay on top of plugin updates and news about newly disclosed flaws. Case in point: a serious vulnerability was recently revealed in WP Customer Reviews that impacts over 30,000 WordPress users.

In this post, we’ll break down this vulnerability, its risks, and most importantly, what you can do to lock down your site. Even if you don’t use this specific plugin, it highlights the need for proper WordPress hygiene.

We’ll also offer recommendations for alternate review plugins and resources to improve your overall website security. Don’t let plugins be your weak spot - arm yourself with knowledge. Let’s dive in and make sure your site stays safe.

What is WP Customer Reviews?

WP Customer Reviews is a popular WordPress plugin with over 1 million downloads. It allows site owners to easily add and manage customer reviews on their website. The plugin is actively maintained and updated.

Vulnerability Details

Researcher Marco Wotschka recently discovered a vulnerability in WP Customer Reviews affecting versions up to and including 3.6.8.

The vulnerability allows authenticated users, including subscribers, to access sensitive information via the ajax_enabled_posts function. This includes post titles, slugs, and details of unpublished or protected content.

The flaw enables privilege escalation and information disclosure. Attackers could leverage exposed private data to further compromise sites. It has a CVSS severity score of 4.3 (Medium).

Risks and Potential Impact

This vulnerability puts over 30,000 WordPress sites at risk. Beyond exposing non-public information, the flaw could enable comment spam, phishing, or further attacks through extracted details.

Hackers with basic subscriber access could scrape sensitive data and customer emails, damage SEO, spread malware, and more. Even without patches, some attacks via this method may be imminent.

Remediating the Vulnerability

Unfortunately at this time no official patch is available from the plugin developer. For optimal security, consider deactivating WP Customer Reviews until an update is released.

Alternate plugins like Yotpo, WP Reviews, and Google Reviews Widget can serve as temporary substitutes. Be sure to monitor the WP Customer Reviews changelog for new releases.

Previous Vulnerabilities

This is one of 5 vulnerabilities identified in WP Customer Reviews since April 2014. The recurrent security issues point to systemic weaknesses in the plugin’s authorization and data handling.

The Importance of Staying Updated

For small business owners on WordPress, the lesson is clear: you must keep plugins updated. This single vulnerability impacts 30,000 sites - imagine the damage from hundreds of flawed plugins.

Sign up for plugin update notifications, test patches quickly, and consider limiting plugins to the essentials. Your livelihood depends on a secure website.

Security vulnerabilities like this one demonstrate the importance of having WordPress experts regularly monitor, maintain and update your site. At Your WP Guy, we offer ongoing management to handle updates, security monitoring, backups, uptime and support so you can stop worrying and get back to growing your business.

Let us fully audit your site to check for any signs of this vulnerability or other issues. We'll immediately update any out-of-date plugins and harden your site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 to lock down your online presence.

WordPress Plugin Vulnerability Report – WP Customer Reviews – Authenticated (Subscriber+) Sensitive Information Exposure – CVE-2023-4686 FAQs

What exactly is the vulnerability in WP Customer Reviews?

The vulnerability, discovered by researcher Marco Wotschka, is a missing authorization issue affecting versions up to and including 3.6.8 of WP Customer Reviews. Specifically, the ajax_enabled_posts function allows authenticated users, even just subscribers, to access and extract sensitive information. This includes unpublished post titles, slugs, and details about protected or trashed content. By exposing non-public data, the vulnerability enables privilege escalation, information disclosure, and further potential attacks.

How serious is this vulnerability?

With a CVSS severity score of 4.3 out of 10, this vulnerability is considered medium risk. However, it still poses a substantial threat given the wide user base of the plugin. Tens of thousands of WordPress sites are impacted, so the vulnerability could lead to widespread comment spam, phishing campaigns, malware distribution, SEO sabotage, and other attacks leveraging extracted information. Hackers could scrape customer email addresses for spam, publish unreleased content, and more.

I use WP Customer Reviews. What should I do?

Since no official patch is available yet, you should strongly consider deactivating or uninstalling WP Customer Reviews for the time being. While inconvenient, this is the only way to fully eliminate the information disclosure risk. You can use alternate plugins like Yotpo or WP Reviews in the interim. Be sure to monitor the WP Customer Reviews changelog and reactivate when the developer releases a fixed version.

How can I tell if my site was compromised?

Carefully review your content, logs, and user activity for any unauthorized changes or access. Signs of compromise could include new users or posts, modified/deleted content, spammy comments, changes to SEO titles/meta, and sudden traffic spikes. You may need to restore from a recent backup if significant alterations occurred. Run a security plugin scan for backdoors or malware.

Are other plugins affected?

Why wasn’t this caught sooner?

Is WordPress itself safe?

What about my hosted WordPress site?

Are plugin vulnerabilities happening more often?

How can I stay on top of WordPress security?

Share this post:

X (Twitter) Facebook Pinterest LinkedIn Email Reddit WhatsApp Pocket SMS

Posted in Security, Vulnerabilities and tagged hacks, Plugin Updates, Plugin Vulnerability, Website Maintenance, Website Security, website upkeep, wordpress plugins, wordpress security, wordpress vulnerability, WP Customer Reviews