Earlier this week one of the most popular WordPress plugins, Maps Widget for Google Maps, which has 100,000+ installs, was closed on the Plugin Directory and then reopened after the name was changed (it was previously Google Maps Widget) and security changes were made. One of the security changes doesn’t really make sense to us. In the file /gmw-tracking.php this line was changed:

62

if (isset($_GET['gmw_tracking']) && $_GET['gmw_tracking'] == 'opt_in') {

It was changed to this:

62
63
64

$gmw_tracking = substr(sanitize_key(@$_GET['gmw_tracking']), 0, 32);
 
if ($gmw_tracking == 'opt_in') {

It’s unclear to us how that would improve security, but that code is in fact insecure for a reason unrelated to that change as we found when we looked over the plugin post closure to see if there were any vulnerabilities that we should be warning customers of our service about if they used this plugin.

The plugin has tracking functionality that is disabled by default. The code above is part of code that enables that, which is accessible to anyone, so even someone not logged in to WordPress could enable the tracking functionality, which is of some concern.

The plugin registers the function init() to run during init, so when WordPress loads:

1438

add_action('init', array('GMW', 'init'));

The last thing that happens in that function, which is located in the file /google-maps-widget.php, is to run another function named init():

109

GMW_tracking::init();

That function in turn runs the function check_opt_in_out():

19
20

  static function init() {
    self::check_opt_in_out();

That functions brings us back where we began this as the begging of the code in that is this:

61
62
63
64
65

  static function check_opt_in_out() {
    $gmw_tracking = substr(sanitize_key(@$_GET['gmw_tracking']), 0, 32);
 
    if ($gmw_tracking == 'opt_in') {
      GMW::set_options(array('allow_tracking' => true));

That will enable the tracking. There are no security check anywhere in the process before that happens, so just by sending a request to the website with the GET parameter “gmw_tracking” set to “opt_in” you can turn on the tracking.

As far as we can tell there isn’t any indication in the admin area of WordPress that tracking is enabled.

Considering that the team running the Plugin Directory appears to be intentionally understaffed and underskilled, mistakes like this are not excusable.

Full Disclosure

Due to the moderators of the WordPress Support Forum’s continued inappropriate behavior we are full disclosing vulnerabilities in protest until WordPress gets that situation cleaned up, so we are releasing this post and then leaving a message about that for the developer through the WordPress Support Forum. You can notify the developer of this issue on the forum as well. Hopefully the moderators will finally see the light and clean up their act soon, so these full disclosures will no longer be needed (we hope they end soon). You would think they would have already done that, but considering that they believe that having plugins, which have millions installs, remain in the Plugin Directory despite them knowing they are vulnerable is “appropriate action”, something is very amiss with them (which is even more reason the moderation needs to be cleaned up).

Update: To clear up the confusion where developers claim we hadn’t tried to notify them through the Support Forum (while at the same time moderators are complaining about us doing just that), here is the message we left for this vulnerability:

Is It Fixed?

If you are reading this post down the road the best way to find out if this vulnerability or other WordPress plugin vulnerabilities in plugins you use have been fixed is to sign up for our service, since what we uniquely do when it comes to that type of data is to test to see if vulnerabilities have really been fixed. Relying on the developer’s information, can lead you astray, as we often find that they believe they have fixed vulnerabilities, but have failed to do that.

Proof of Concept

The following proof of concept will enable tracking.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/?gmw_tracking=opt_in

Concerned About The Security of the Plugins You Use?

Need Continued Support for a Closed Plugin?