Today’s post is part one of a two part blog post. It describes a cross site scripting vulnerability that exploits the PHP_SELF variable. Tomorrow we will publish part two, which describes another plugin suffering from a similar vulnerability related to the use of PHP_SELF. So be sure to look out for that post via our mailing list, which you can join on this page, in case you’re not already a member.
On August 16, 2021, the Wordfence Threat Intelligence team attempted to initiate disclosure for a reflected Cross-Site Scripting vulnerability in underConstruction, a WordPress plugin with over 80,000 installations.
After 2 weeks without a response, we forwarded the issue to the WordPress plugins team on August 30, 2021. A patched version, 1.19, was released the next day, on August 31, 2021.
A firewall rule protecting against this vulnerability was released to Wordfence Premium users on August 16, 2021, and became available to sites using the free version of Wordfence on September 15, 2021.
If you aren’t running Wordfence, and are a user of this plugin, we recommend you immediately upgrade to version 1.19 of underConstruction which contains the patch.
Description: Reflected Cross-Site Scripting
Affected Plugin: underConstruction
Plugin Slug: underconstruction
Affected Versions: <= 1.18
CVE ID: CVE-2021-39320
CVSS Score: 6.1 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Researcher/s: Ramuel Gall
Fully Patched Version: 1.19
The underConstruction plugin options page contained a settings form which echoed out the value of the $GLOBALS[‘PHP_SELF’] variable as its submission target.
action=”<?php echo $GLOBALS[‘PHP_SELF’] . ‘?page=’ . $this->mainOptionsPage; ?>”
Sites running Nginx or Apache+PHP-FPM do not store the additional path information required for the vulnerability to work by default, but some shared hosting providers may enable this functionality for compatibility with other software.
August 16, 2021 – Wordfence Threat Intelligence finds the vulnerability and attempts to contact the plugin developer. We release a firewall rule to protect Wordfence Premium users.
August 30, 2021 – After 2 weeks without a response we contact the WordPress plugins team.
August 31, 2021– A patched version of the plugin is made available.
September 15, 2021 – Sites running the free version of Wordfence receive the firewall rule.
During the research that led us to this vulnerability, we found a second, similar vulnerability in another plugin with over 40,000 installations, which we’ll cover in more detail in tomorrow’s post.
WordPress Premium users have been protected against this vulnerability since August 16, 2021. Sites still running the free version of Wordfence received the same protection on September 15, 2021. Nonetheless we strongly recommend updating to the latest version available, 1.19, as soon as possible.
If you believe your site has been compromised as a result of this or any other attack, Wordfence offers professional Site Cleaning services. Our Security Analysts remove any malware found, and also determine the intrusion vector if possible, as well as providing recommendations to prevent future infections.
If anyone you know is using the underConstruction plugin, please forward this article to them and encourage them to update.