The changelog for the latest version of the plugin All In One WP Security (All In One WP Security & Firewall) is “Fixed vulnerability related to open redirect and exposure of hidden login page for specific case. (Thanks to Erwan (wpscanteam) for letting us know)”. The entry on the WPScan Vulnerability Database for that contains almost no information and has this for the proof of concept “The PoC will be displayed on October 22, 2019, to give users the time to update.” It is unclear what the point of that would be since, that would be too late for that to be to all that useful, say if the vulnerability hasn’t been properly fixed, since hackers would already be taking advantage of the vulnerability. At the same time we have a hard time believing anybody looking to exploit this would have any trouble figuring out how you could exploit it just by looking at the relevant changes made to the plugin, considering it took us around a minute.

The plugin registers the function plugins_loaded_handler() to run during the action “plugins_loaded”, so after plugins have loaded:

129

add_action('plugins_loaded',array(&$this, 'plugins_loaded_handler'));//plugins loaded hook

That in turn causes the function do_additional_plugins_loaded_tasks() to run:

167
168
169
170
171
172
173
174

function plugins_loaded_handler()
{
	//Runs when plugins_loaded action gets fired
	if(is_admin()){
		//Do plugins_loaded operations for admin side
		$this->db_upgrade_handler();
	}
	$this->do_additional_plugins_loaded_tasks();

In that function is the GET input “aiowpsec_do_log_out” exists the request will be redirected to URL specified by the GET input “after_logout” through the redirect_to_url() function:

224
225
226
227
228
229
230
231
232
233

function do_additional_plugins_loaded_tasks()
{
	global $aio_wp_security;
	if(isset($_GET['aiowpsec_do_log_out']))
	{
		wp_logout();
		if(isset($_GET['after_logout']))//Redirect to the after logout url directly
		{
			$after_logout_url = esc_url($_GET['after_logout']);
			AIOWPSecurity_Utility::redirect_to_url($after_logout_url);

That is an open redirect vulnerability.

In the new version a valid nonce is checked for before that happens, which prevents that:

224
225
226
227
228
229
230
231
232

function do_additional_plugins_loaded_tasks()
{
	global $aio_wp_security;
	if(isset($_GET['aiowpsec_do_log_out']))
	{
		$nonce = isset($_GET['_wpnonce'])?$_GET['_wpnonce']:'';
		if ( !wp_verify_nonce( $nonce, 'aio_logout' ) ) {
			return; 
		}

The “exposure of hidden login page” occurred if the GET input “aiowpsec_do_log_out” existed, but the GET input “after_logout” didn’t.

Proof of Concept

The following proof of concept will redirect you to our homepage.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/?aiowpsec_do_log_out&after_logout=https://www.pluginvulnerabilities.com