A dangerous vulnerability (CVE-2022-0633) has been identified in the UpdraftPlus WordPress plugin, which has over 3 million active installations. This vulnerability allows an unauthorized user to download a copy of the site's database, which contains not only the content but also user parameters and password hashes. The issue has been resolved in versions 1.22.3 and 2.22.3, which are recommended for all UpdraftPlus users to install as soon as possible.
UpdraftPlus is presented as the most popular backup plugin for websites powered by the WordPress platform. Due to improper access control checks, the plugin allowed backups of the site and associated databases to be downloaded not only by administrators but by any registered user of the site, such as those with subscriber status.
To download backups in UpdraftPlus, an identifier is generated based on the creation time of the backup and a random sequence (nonce). The problem lies in the fact that due to the lack of proper checks in the WordPress heartbeat request handler, an attacker can retrieve information about the latest backup through a specially formatted request, which includes details about the time and the associated random sequence.
Next, based on the information obtained, an identifier can be formed and a backup can be uploaded using the email upload method. The function maybe_download_backup_from_email used in this method requires accessing the options-general.php page, which is only available to administrators. However, an attacker can bypass this restriction by spoofing the variable $pagenow used in the check and sending a request through a service page that allows non-privileged users to access it. For example, one can access the administrator message submission page, sending a request as "wp-admin/admin-post.php//wp-admin/options-general.php?page=updraftplus".
Source: opennet.ru
