Settings change vulnerability in WordPress Search Exclude plugin.

The WordPress Search Exclude plugin, which has 30,000+ active installations, was prone to two vulnerabilities that could allow anyone to change its settings in version 1.2.2 and below.

Reference

CVE-2019-15895

Unauthenticated settings change via admin_init

In the main “search-exclude.php” script, line 40, the plugin registers the saveOptions function via the admin_init hook:

add_action('admin_init', array($this, 'saveOptions') );

The function, located lines 297-304, lacks capability check and a security nonce:

public function saveOptions()
{
   if (isset($_POST['search_exclude_submit'])) {

      $excluded = $_POST['sep_exclude'];
      $this->saveExcluded($excluded);
   }
}

Because the admin_init hook can be triggered by anyone, as we have seen in the Ocean Extra and Easy WP SMTP plugins vulnerability reports, an unauthenticated user can change the settings of the plugin.

Authenticated settings change via AJAX

Line 56, the plugin registers the saveBulkEdit function via the wp_ajax_* hook:

add_action('wp_ajax_search_exclude_save_bulk_edit', array($this, 'saveBulkEdit'));

The function, located lines 141-148, lacks capability check and a security nonce, allowing an authenticated user, such as a subscriber, to change the settings via WordPress AJAX API:

public function saveBulkEdit()
{
   $postIds = !empty($_POST['post_ids']) ? $_POST[ 'post_ids' ] : false;
   $exclude = isset($_POST['sep_exclude']) && '' !== $_POST['sep_exclude']  ? $_POST[ 'sep_exclude' ] : null;
   if (is_array($postIds) && null !== $exclude) {
       $this->savePostIdsToSearchExclude($postIds, $exclude);
    }
}

Timeline

The vulnerability was discovered and reported to the wordpress.org team on August 30, 2019.

Recommendations

Update as soon as possible if you have version 1.2.2 or below installed.
If you are using our web application firewall for WordPress, NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium), you are protected against this vulnerability.

Stay informed about the latest vulnerabilities in WordPress plugins and themes: @nintechnet