One of the ways we help to improve the security of WordPress plugins, not just for our customers, but for everyone using them, is the proactive monitoring of changes made to plugins in the Plugin Directory to try to catch serious vulnerabilities. That again has lead to us catching a vulnerability of a type that hackers are likely to exploit if they know about it.

This vulnerability is in a brand new plugin, HappyForms, and should have been something that the security review that is supposed to be done before new plugins can be added to the Plugin Directory should have caught. It is something that would have been flagged by our Plugin Security Checker, so it would make sense to run plugins through that during that security review to avoid this type of situation continuing to happen. That it continues to happen speaks to the continued lack of interest in improving security by the leadership of WordPress (starting at the top with Matt Mullenweg) and the continued role we play in limiting the impact of that for everyone else. We would be happy to provide the Plugin Directory team free access to the upload and developer mode capabilities to facilitate that.

The vulnerability occurred in function read() in the file /inc/classes/class-message-notices.php where the value of the cookie “happyforms-message-notices” was passed through the unserialize() function, which can lead to PHP object injection:

108
109
110
111
112

public function read() {
	$this->messages = array();
 
	if ( isset( $_COOKIE[ $this->cookie_name ] ) && ! empty( $_COOKIE[ $this->cookie_name ] ) ) {
		$this->messages = unserialize( stripslashes( $_COOKIE[ $this->cookie_name ] ) );

That function will run anytime a non-admin page is being accessed:

67
68
69

if ( ! is_admin() ) {
	add_action( 'send_headers', array( $this, 'read' ) );
}

After we notified the developer of the issue, they released version 1.1, which resolves the vulnerability by replacing use of unserialize() with json_decode() (and replaces related use of serialize() with json_encode()):

112

$this->messages = json_decode( stripslashes( $_COOKIE[ $this->cookie_name ] ), true );

Proof of Concept

With our plugin for testing for PHP object injection installed and activated, set the value of the cookie “happyforms-message-notices” to “O:20:”php_object_injection”:0:{}” and then when you visit a frontend page the message “PHP object injection has occurred.” will be shown.

Timeline

• February 13, 2018 – Developer notified.
• February 14, 2018 – Developer responds.
• March 13, 2018 – Version 1.1 released, which fixes vulnerability.

Concerned About The Security of the Plugins You Use?