Researchers at High-Tech Bridge have identified several vulnerabilities in TheCartPress, an eCommerce plugin installed on more than 5,000 WordPress websites.
According to experts, the plugin is plagued by security holes that can be exploited for cross-site scripting (XSS) attacks, arbitrary PHP code execution, and sensitive data disclosure.
Researchers uncovered several XSS vulnerabilities (CVE-2015-3300). One of them, a stored XSS, affects the checkout process and is caused by the lack of user input sanitization in some fields of the “Shipping address” and “Billing address” sections.
An unauthenticated attacker can exploit the vulnerability to inject malicious HTML or JavaScript code into vulnerable websites in an effort to target users and administrators, High-Tech Bridge said in its advisory.
Four other XSS flaws discovered by experts can be exploited by an attacker to get website administrators to execute arbitrary code by tricking them into clicking on a specially crafted link.
Researchers have also identified a local PHP file inclusion vulnerability (CVE-2015-3301) that can be leveraged to include arbitrary local files via directory traversal sequences. The vulnerability can be exploited by an attacker that has administrative privileges or via a cross-site request forgery (CSRF) exploit.
Finally, High-Tech Bridge reported uncovering an improper access control bug (CVE-2015-3302). An unauthenticated attacker can exploit a broken authentication mechanism to gain access to the orders placed by users on online stores running vulnerable versions of TheCartPress.
According to High-Tech Bridge, the vulnerabilities affect TheCartPress 1.3.9 and probably earlier versions. The security firm has attempted to report the flaws to the developer on several occasions this month, but without success.
A notice posted on thecartpress.com informs users that support for the plugin ends on June 1, 2015, so it’s possible that the vulnerabilities will never get fixed. TheCartPress developers have not responded to SecurityWeek’s request for comment by the time of publication.
Since a patch is not available, High-Tech Bridge advises users to disable or remove TheCartPress plugin from their WordPress websites.
High-Tech Bridge published on Wednesday an advisory to inform users of the existence of a medium severity XSS vulnerability in WP Photo Album Plus, a plugin designed to allow administrators to easily manage and display their photos, albums, slideshows and videos on WordPress websites. The plugin is currently installed on more than 50,000 websites.
The details of the vulnerability will only be disclosed on May 20, but a fix has already been made available with the release of version 6.1.3.
UPDATE: TheCartPress developers told SecurityWeek on Sunday, May 3, that they have released a new version of the plugin to address the security bugs.
Related: Magento Flaw Exploited in the Wild Within 24 Hours After Disclosure
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Google Patches Third Chrome Zero-Day of 2023
- ChatGPT Hallucinations Can Be Exploited to Distribute Malicious Code Packages
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
Latest News
- In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption
- Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats
- Google Introduces SAIF, a Framework for Secure AI Development and Use
- ‘Asylum Ambuscade’ Group Hit Thousands in Cybercrime, Espionage Campaigns
- Evidence Suggests Ransomware Group Knew About MOVEit Zero-Day Since 2021
- SaaS Ransomware Attack Hit Sharepoint Online Without Using a Compromised Endpoint
- Google Cloud Now Offering $1 Million Cryptomining Protection
- Democrats and Republicans Are Skeptical of US Spying Practices, an AP-NORC Poll Finds
