Insufficient Privilege Validation in WooCommerce Checkout Manager

Due to the poor handling of a vulnerability disclosure, a new attack vector has appeared for the WooCommerce Checkout Manager WordPress plugin and is affecting over 60,000 sites. If you are using this plugin, we recommend that you update it to version 4.3 immediately.

As we’ve seen some exploit attempts occurring in the wild, we feel it is a good time to describe what the issue is.

Current State of the Vulnerability

This arbitrary file upload vulnerability was made public a few weeks ago and has recently been patched. It can be exploited by unauthenticated remote attackers if users have the Categorize Uploaded Files option enabled in the plugin settings.

What Is It All About?

A WordPress plugin enables API routes by registering actions with either wp_ajax_ for authenticated or wp_ajax_nopriv_ for unauthenticated calls. Plugins using wp_ajax_nopriv_ actions should be fine as long as they are not giving access to methods with critical functionalities.

Unfortunately, vulnerable versions of the WooCommerce Checkout Manager are giving access to an upload functionality without using the proper restrictions. Under certain circumstances, this can allow a bad actor to upload malicious files to the affected site, modify data, or gain administrative access.

Indicators of Compromise

You can look for requests pointing to the PHP file /wp-admin/admin-ajax.php with the following parameter in your access logs:

• wccs_upload_file_func
• order_id
• Name

Protect Yourself

Users with vulnerable versions of this plugin should update to version 4.3 as soon as possible, however, it’s worth noting that this vulnerability was left unpatched for weeks. Due to the unresponsive nature of the development team, we’d encourage you to pursue other plugin options that have more active development teams and demonstrate a concern for security.

If you’re seeing symptoms of a hack and need a hand cleaning it up, contact us—we’d be happy to help clean up your site.

Note: Users of our Web Application Firewall (WAF) product are already protected against this threat via our virtual patching feature.