Not Really a WordPress Plugin Vulnerability, Week of October 28
In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.
PHP Object Injection in LearnPress
Automattic’s WPScan claimed a PHP object injection vulnerability had existed in LearnPress. The proof of concept provided doesn’t work, despite their claim to have verified this. The description for the claimed vulnerability explains why that is, without acknowledging the proof of concept doesn’t work. They wrote this:
The plugin unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.
So exploitation would require the attacker to have access to “site secrets”, which they don’t define or explain how the attacker would actually have access to.
This could be described as a security issue, but to call it a vulnerability wouldn’t be accurate when it is tacitly admitted that it can’t be exploited.
This false report was given a CVE id by WPScan, CVE-2022-3360, despite not really being a vulnerability.