SB2019111104 - Multiple vulnerabilities in IgniteUp plugin for WordPress
Published: November 11, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2019-17237)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the "createCsvFile" and "createBccFile" functions do not check the user capabilities and lack a security nonce. A remote attacker can gain unauthorized access to sensitive information on the system, such as download all email addresses.
2) Stored cross-site scripting (CVE-ID: CVE-2019-17236)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "subscribeEmail" function in the “includes/views/admin-subscribers.php” script. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) Cross-site request forgery (CVE-ID: CVE-2019-17235)
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in the contact form. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
4) Improper Privilege Management (CVE-ID: CVE-2019-17234)
The vulnerability allows a remote attacker to escalate privilege on the target system.
The vulnerability exists due to the "deleteTemplate" function in the “includes/class-coming-soon-creator.php” script does not check the user capabilities and lacks a security nonce. A remote attacker can execute that function to delete any file or folder on the website.
5) Improper access control (CVE-ID: N/A)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions in the "removeSubscribers" and "activateTemplate" functions. A remote attacker can bypass implemented security restrictions and delete subscribers or switch the plugin’s template.
Remediation
Install update from vendor's website.