CVE-2022-38137 - Simple Guide to Analytify <=4.2.2 WordPress Plugin CSRF Vulnerability

If you’re a WordPress user or a website administrator, you know plugins can make or break your site—sometimes literally. One such plugin is Analytify, loved by many for bringing Google Analytics right into WordPress dashboards. However, up to version 4.2.2, Analytify had a serious problem: a Cross-Site Request Forgery (CSRF) vulnerability, known as CVE-2022-38137.

In this post, we’ll break down what this vulnerability was, how someone could exploit it, and steps you can take to stay safe.

Fixed in: 4.2.3

CSRF, simply put, tricks a logged-in user into doing things they didn’t intend—like changing website settings—by making them unknowingly send HTTP requests.

Original Reference Links

- WordFence Detailed Advisory
- NVD: CVE-2022-38137
- WPScan Analysis
- Analytify Plugin on WordPress.org

How Did the Vulnerability Work?

When users are logged into WordPress, they have a “session.” Analytify, in the vulnerable versions, did not check if requests for changing certain settings came from a legitimate source (like their own admin dashboard).

This meant

- Anybody could craft an HTTP request (in an email, or a malicious webpage) that, when visited by a logged-in admin, would execute actions like updating Analytify’s plugin settings.
- Because there was no CSRF protection (like a nonce check), an attacker could sneakily make changes as if they were the admin.

Let’s look at a simple exploit scenario

1. Attacker builds a malicious site or HTML email containing a POST request that will interact with the Analytify settings endpoint.
2. Victim (WordPress logged-in admin) visits the malicious site or clicks a crafted link while still logged into their WordPress site.
3. The browser sends the malicious request to the vulnerable endpoint in the WordPress admin, potentially changing settings without the victim's knowledge.

Suppose the plugin endpoint for saving settings is

POST /wp-admin/admin.php?page=analytify-settings&action=save

A malicious attacker could create a form like this

<html>
  <body>
    <form action="https://victim-site.com/wp-admin/admin.php?page=analytify-settings&action=save"; method="POST">
      <input type="hidden" name="analytify_license_key" value="attacker_license_key_here">
      <input type="hidden" name="some_other_option" value="malicious_value">
    </form>
    <script>
      document.forms[].submit();
    </script>
  </body>
</html>

- The admin visits the attacker's page, the form auto-submits, and—if logged in—the victim’s Analytify settings change, possibly deactivating the plugin or redirecting analytics data (license keys, API keys, etc.).

Potential exploit impacts

- Disable tracking: Attackers might turn off your Google Analytics, hiding their own activity or sabotaging site stats.

How Was CVE-2022-38137 Fixed?

To prevent CSRF, good plugins use WordPress nonces—unique security tokens for each action.

After the vulnerability was disclosed, the Analytify team released version 4.2.3, which added proper nonce verification to all sensitive actions.

Example Fix (PHP code concept)

if ( ! isset( $_POST['analytify_nonce'] ) || ! wp_verify_nonce( $_POST['analytify_nonce'], 'analytify_save_settings' ) ) {
    wp_die( 'Security check failed' );
}

Consider a security plugin

Tools like WordFence can provide extra layers of security.

5. Review your site for unexpected changes, especially in plugin settings after any CSRF vulnerabilities are disclosed.

Conclusion

CVE-2022-38137 is a reminder that even popular and trusted plugins can have security bugs. All it takes is forgetting a simple nonce check to open the door to serious site compromise. Keeping plugins updated, and understanding basic web security principles, will help you keep your WordPress site as secure as possible.

Timeline

Published on: 11/08/2022 19:15:00 UTC
Last modified on: 11/09/2022 14:42:00 UTC