RIPS Technologies discovered a problem with WordPress and the e-commerce plugin WooCommerce created by Automattic. According to official statistics, this solution has been downloaded more than four million times and has roughly the same number of active installations.
Researchers explain that there are two problems here. The first problem is that when the plugin is installed for WordPress, which uses different roles for users, it does not create its own authentication system but instead uses the existing CMS privilege system. To do this, the plugin creates a new role with WordPress’s new capabilities, then restricts its interaction with CMS settings and other users through its own functions.
Thus, when WooCommerce is installed, a new role is created for Shop Manager (“store manager”), which has edit_users rights. This permission allows the user to modify posts as well as the profiles of any other WordPress user, including the administrator.
It seems that the WooCommerce developers provided a function that prevents users with this role from interfering with administrator profiles. However, due to a flaw in how the plugin privilege management system works, when WooCommerce is deactivated, the “store manager” restriction function stops working, and users with this role can freely modify other users’ accounts.
Therefore, the only reliable way to deactivate the plugin is to deactivate it as an administrator and delete all of its files. And here is the second problem.
The fact is that analysts at RIPS Technologies discovered a bug related to deleting WooCommerce files in version 3.4.5 and earlier. It turned out that users with Shop Manager rights can delete any file of the plugin, including those essential to its operation. As a result, the plugin will stop working predictably, WordPress will deactivate it automatically, and the situation returns to the previous state, where a user with the store manager role can modify the profiles of any user.
Researchers explain that in such a situation, the attacker will have no difficulty capturing the administrator account and thus taking control of the entire site. The video below illustrates a combination of the two problems in this case.
Experts point out that, to use this system successfully, an attacker must have access to an account with the shop manager role. However, according to the researchers, this is achievable through XSS vulnerabilities or phishing attacks.
WooCommerce developers have already eliminated the problem by releasing a new version of the plugin (3.4.6). Since automatic plugin updates are not included at all, experts recommend that users check for updates and make sure they are running the latest versions of WooCommerce.
