Advertisement
  1. SEJ
  2.  » 
  3. WordPress

WordPress Backup Plugin Vulnerability Impacted 3+ Million Installations

UpdraftPlus WordPress Plugin vulnerability potentially compromised over 3 million installations

WordPress Backup Plugin Vulnerability Impacted 3+ Million Installations

Security researcher at Automattic discovered a vulnerability affecting popular WordPress backup plugin, UpdraftPlus. The vulnerability allowed hackers to download user names and hashed passwords. Automattic calls it a “severe vulnerability.”

UpdraftPlus WordPress Backup Plugin

UpdraftPlus is a popular WordPress backup plugin that’s actively installed in over 3 million websites.

The plugin allows WordPress administrators to backup their WordPress installations, including the entire database which contains user credentials,  passwords and other sensitive information.

Publishers rely on UpdraftPlus to adhere to the highest standards of security in their plugin because of how sensitive the data is that’s backed up with the plugin.

UpdraftPlus Vulnerability

The vulnerability was discovered by an audit conducted by a security researcher at Automattic’s Jetpack.

They discovered two previously unknown vulnerabilities.

The first was related to how UpdraftPlus security tokens called, nonces, could be leaked. This allowed an attacker to obtain the backup, including the nonce.

According to WordPress, nonces are not supposed to be the main line of defense against hackers. It explicitly states that functions should be protected by properly validating who has the proper credentials (by using the function called current_user_can()).

WordPress explains:

“Nonces should never be relied on for authentication, authorization, or access control. Protect your functions using current_user_can(), and always assume nonces can be compromised.”

The second vulnerability was tied to an improper validation of a registered users role, precisely what WordPress warns that developers should take steps to lock down plugins.

The improper user role validation allowed someone with the data from the previous vulnerability to download any of the backups, which of course contains sensitive information.

Jetpack describes it:

“Unfortunately, the UpdraftPlus_Admin::maybe_download_backup_from_email method, which is hooked to admin_init didn’t directly validate users’ roles either.

While it did apply some checks indirectly, such as checking the $pagenow global variable, past research has shown that this variable can contain arbitrary user input.

Bad actors could use this endpoint to download file & database backups based on the information they leaked from the aforementioned heartbeat bug.”

The United States Government National Vulnerability database warns that UpdraftPlus didn’t “…properly validate a user has the required privileges to access a backup’s nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.”

WordPress Forced Updates of UpdraftPlus

The vulnerability was so severe, WordPress took the extraordinary step of forcing automatic updates on all installations that hadn’t yet updated UpdraftPlus to the latest version.

But publishers are recommended to take it for granted that their installation was updated.

Affected Versions of UpdraftPlus

UpdraftPlus free versions before 1.22.3 and UpdraftPlus premium versions before 2.22.3 are vulnerable to the attack.

It’s recommended that publishers check to see that they are using the very latest version of UpdraftPlus.

Citations

Read the Jetpack Announcement

Severe Vulnerability Fixed In UpdraftPlus 1.22.3

Read the UpdraftPlus Announcement

UpdraftPlus security release – 1.22.3 / 2.22.3 – please upgrade

Read the U.S. Government Documentation on the Vulnerability

CVE-2022-0633 Detail

Category News WordPress
ADVERTISEMENT

Subscribe to SEJ

Get our daily newsletter from SEJ's Founder Loren Baker about the latest news in the industry!

Topic(s) of Interest*
By clicking the "SUBSCRIBE" button, I agree and accept the content agreement and privacy policy of Search Engine Journal.
Ebook

Roger Montti

Owner at Martinibuster.com

Roger Montti is a search marketer with over 20 years experience. I offer site audits, phone consultations and content and ... [Read full bio]

ADVERTISEMENT
Advertisement
Read the Next Article
Read the Next