10Web’s Event Calendar WD (EventCalendar) Contains Authenticated Information Vulnerability and Other Security Issues
One of the more troubling aspects of the poor security of WordPress plugins is that so many companies are both handling the security of their plugins rather poorly and trying to profit from the insecurity that they are helping to create. We discussed one example of that a year ago, involving plugin developer 10Web’s poor handling of the security of their plugins, while selling a security service and partnering with another company that is trying to profit off the insecurity, Patchstack. That post dealt in part with 10Web’s failed attempt to a fix a vulnerability in the Event Calendar WD (EventCalendar) plugin and the subsequent failure to get that resolved after we let them know it hadn’t been fixed. While the partnership with Patchstack was supposed to improve the security of the WordPress ecosystem, it didn’t even lead to 10Web’s plugins being properly secured.
On Monday, Event Calendar WD was closed on WordPress Plugin Directory. Unhelpful for those using it, no explanation was provided on why it was closed (as is the case with all plugin closures there). As at least one of our customers is using the plugin, we took a look to see if there might be a serious vulnerability that could have led to the closure, which we should be warning them about. We didn’t find such a vulnerability. But just in the limited checking we did for that, we found various security issues with the plugin. We confirmed there is at least one vulnerability and there are likely others.
One of the things we check when looking for serious vulnerabilities is insecure functionality registered to run thorough admin_action. This plugin registered one function to be accessed through that:
48 | add_action('admin_action_duplicate_ecwd_post', array($this, 'duplicate_post')); |
The functionality, which is in the file /includes/ecwd-cpt-class.php, allows anyone logged in to WordPress to duplicate arbitrary posts:
161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 | public function duplicate_post() { global $wpdb; if (!( isset($_GET['post']) || isset($_POST['post']) || ( isset($_REQUEST['action']) && 'ecwd_duplicate_post' == $_REQUEST['action'] ) )) { wp_die('No post to duplicate has been supplied!'); } /* * get the original post id */ $post_id = ( isset($_GET['post']) ? sanitize_text_field($_GET['post']) : sanitize_text_field($_POST['post'] )); /* * and all the original post data then */ $post = get_post($post_id); $current_user = wp_get_current_user(); $new_post_author = $current_user->ID; /* * if post data exists, create the post duplicate */ if (isset($post) && $post != null) { /* * new post data array */ $args = array( 'comment_status' => $post->comment_status, 'post_type' => $post->post_type, 'ping_status' => $post->ping_status, 'post_author' => $new_post_author, 'post_content' => $post->post_content, 'post_excerpt' => $post->post_excerpt, 'post_name' => $post->post_name, 'post_parent' => $post->post_parent, 'post_password' => $post->post_password, 'post_status' => $post->post_status, 'post_title' => $post->post_title, 'post_type' => $post->post_type, 'to_ping' => $post->to_ping, 'menu_order' => $post->menu_order ); /* * insert the post by wp_insert_post() function */ $new_post_id = wp_insert_post($args); |
That is only intended to be used to duplicate the posts created by the plugin, but it can duplicate any post. One way that functionality could be abused is to give a lower level WordPress user access to the content of a post that they are otherwise restricted from accessing.
WordPress Causes Full Disclosure
As a protest of the moderators of the WordPress Support Forum’s continued inappropriate behavior we changed from reasonably disclosing to full disclosing vulnerabilities for plugins in the WordPress Plugin Directory in protest, until WordPress gets that situation cleaned up, so we are releasing this post and then leaving a message about that for the developer through the WordPress Support Forum. (For plugins that are also in the ClassicPress Plugin Directory, we will follow our reasonable disclosure policy.)
You can notify the developer of this issue on the forum as well.
Hopefully, the moderators will finally see the light and clean up their act soon, so these full disclosures will no longer be needed (we hope they end soon). You would think they would have already done that, but considering that they believe that having plugins, which have millions installs, remain in the Plugin Directory despite them knowing they are vulnerable is “appropriate action”, something is very amiss with them (which is even more reason the moderation needs to be cleaned up).
If the moderation is cleaned up, it would also allow the possibility of being able to use the forum to start discussing fixing the problems caused by the very problematic handling of security by the team running the Plugin Directory, discussions which they have for years shut down through their control of the Support Forum.
Update: To clear up the confusion where developers claim we hadn’t tried to notify them through the Support Forum (while at the same time moderators are complaining about us doing just that), here is the message we left for this vulnerability:
Is It Fixed?
If you are reading this post down the road the best way to find out if this vulnerability or other WordPress plugin vulnerabilities in plugins you use have been fixed is to sign up for our service, since what we uniquely do when it comes to that type of data is to test to see if vulnerabilities have really been fixed. Relying on the developer’s information can lead you astray, as we often find that they believe they have fixed vulnerabilities, but have failed to do that.
Proof of Concept
As an Administrator, create a password protected post.
As a Contributor, use the following proof of concept to duplicate post.
Replace “[path to WordPress]” with the location of WordPress and “[post ID]” with the ID of the post.
http://localhost/wordpress/wp-admin/post.php?action=edit&post=[post ID]