WordPress Plugin Vulnerability Found on 80,000 Sites
Security researchers discovered a vulnerability in a relatively popular WordPress plugin used on commercial websites. The plugin in question is called Variation Swatches for WooCommerce and is found on approximately 80,000 websites running WordPress and the WooCommerce e-commerce plugin.
The vulnerability was discovered in stored cross-scripting functionality of the Variation Swatches for WooCommerce plugin. The severity of the issue is significant, as according to researchers the issue could potentially allow threat actors to inject pages with malicious scripts and even take over entire websites.
The purpose of the Variation Swatches plugin, as the name suggests, is to allow anyone running a retail website to display multiple variations of the same base product. For example, a pair of shoes that come in blue, black and brown leather would be displayed on three different swatches. However, versions of the plugin containing the vulnerability allow anyone without admin privileges, even page visitors, to tamper with the plugin's settings.
Three separate functions in the Swatches plugin's code were implemented without "capability checks and nonce checks" according to researchers from Wordfence. One of those three functions allows unprivileged users to both tweak the plugin's settings and insert malicious code that would run when the legitimate website administrator opens the plugin's settings.
The vulnerability was tracked under the CVE-2021-42367 designator and was eventually patched out with an update that was released on November 23.
The last few months saw an unpleasant cavalcade of bugs being documented and eventually fixed, related to the WordPress platform in some way. We have covered a number of those, including another plugin bug that allowed unprivileged users to wipe entire websites, and the fake ransomware scare that was related to another WordPress plugin.
