Identity & Access Management
,
Security Operations
Critical Authentication Flaw Impacts Both Free and Pro Users
A widely deployed five-in-one security plugin for WordPress websites contained a flaw that hackers could automate into a large-scale takeover campaign.
See Also: 2024 Threat Hunting Report: Insights to Outsmart Modern Adversaries
WordPress security firm Wordfence called the flaw, tracked as CVE-2024-10924, “one of the more serious vulnerabilities that we have reported on in our 12 year history.”
The critical authentication bypass vulnerability takes advantage of a now-patched flaw in the Really Simple Security plugin, active across more than 4 million websites. WordPress.org began forced updates on Thursday. “We urge users to verify that their sites were updated to the latest patched version of Really Simple Security, version 9.1.2,” Wordfence researchers wrote. The flaw impacts free, Pro and Pro Multisite editions.
The flaw stems from improper handling of user verification during two-factor authentication processes via the REST API, which is a protocol for systems to communicate over the web. Only plugins that enable two-factor authentication for login are affected by the flaw, and the setting is disabled by default. Really Simple Security contains functions for managing website certificates, vulnerability detection, login protection and WordPress hardening.
Specifically, the error is in how the plugin returned an error message in the case of a two factor authentication failure. Prior to the patch, the plugin did not handle the error message within the function, meaning that even in the case of an invalid response, a hacker could continue logging on. “Even in the case of an invalid nonce, the function processing continues and invokes authenticate_and_redirect(), which authenticates the user based on the user id passed in the request, even when that user’s identity hasn’t been verified,” Wordfence wrote.
WordFence researchers disclosed the vulnerability to the developer team on Nov. 6. The falw, which has a 9.8 rating on the ten-point CVSS scale, is scriptable, “meaning that it can be turned into a large scale automated attack.”