In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.

Easy Forms for Mailchimp

One of the changelog entries for version 6.5.3 of Easy Forms for Mailchimp is “Fixed admin input field code injection vulnerability. Thanks to Henri Salo from Nixu Corporation for finding and reporting this to us.” The relevant change looks to involve this line:

28

<input autocomplete="off" <?php if ( $yikes_mc_api_constant ) { echo 'readonly="readonly"'; } if( strlen( yikes_get_mc_api_key() ) > 0 ) { ?> type="password" <?php } else { ?> type="text" <?php } ?> value="<?php echo yikes_get_mc_api_key(); ?>" placeholder="<?php _e( 'Mailchimp API Key' , 'yikes-inc-easy-mailchimp-extender' ); ?>" name="yikes-mc-api-key" id="yikes-mc-api-key" class="settings-page-input" />

Which had escaping added when outputting the value of the function yikes_get_mc_api_key():

46

>input autocomplete="off" >?php if ( $yikes_mc_api_constant ) { echo 'readonly="readonly"'; } if( strlen( yikes_get_mc_api_key() ) > 0 ) { ?> type="password" >?php } else { ?> type="text" >?php } ?> value=">?php echo esc_attr( yikes_get_mc_api_key() ); ?>" placeholder=">?php _e( 'Mailchimp API Key' , 'yikes-inc-easy-mailchimp-extender' ); ?>" name="yikes-mc-api-key" id="yikes-mc-api-key" class="settings-page-input" />

The value is returned comes from either a constant or a WordPress option:

199
200
201
202
203
204
205

function yikes_get_mc_api_key() {
	if ( defined( 'YIKES_MC_API_KEY' ) ) {
		return trim( strip_tags( YIKES_MC_API_KEY ) );
	}
 
	return trim( strip_tags( get_option( 'yikes-mc-api-key', '' ) ) );
}

The constant is defined in PHP code, so if someone could define a malicious value for that they likely could do something more directly malicious.

The WordPress option is properly secured, so if that was the only place where the value could come from we wouldn’t classify this as a vulnerability, since only Administrators can change that and they can do almost anything.