WordPress GDPR Plugin Vulnerable to Cross-Site Scripting Attacks

GDPR Cookie Consent, a WordPress plugin, inadvertently exposed websites to cross-site scripting (XSS) attacks through a vulnerability that affects versions 1.8.2 and below of the plugin. As disclosed in a report by NinTechNet, the vulnerability allowed privilege escalation. The plugin had over 700,000 active installations at the time of the exploit.

Figure 1. Vulnerable code in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php

Figure 2. The autosave_contant_data function, which can be used to perform an XSS attack

The second of the two functions, save_contentdata, allows the attacker to send information to the backend database and modify page content. In addition, by setting the status of the page to draft instead of published, an attacker can use the function to make parts of the website invisible to the public and leverage this for a Denial of Service (DoS) attack.

Figure 3. The save_contentdata function, which can be used to modify page structure and potentially cause DoS 

Patch details

The improper access control vulnerability was patched in version 1.8.3. The patch adds an additional check to the ajax_policy_generator function called by __construct to verify that the user’s nonce value is valid and that it has the correct permissions to modify the plugin content. With the patched constructor function, users without correct permissions will no longer be able to use autosave_contant_data or save_contentdatato inject code.

Figure 4: Check added to the ajax_policy_generator function to patch the access control vulnerability

Everyone using this plugin should update to the latest version (>= 1.8.3) as soon as possible to mitigate the risk.

Protecting systems against compromise

• 1010194 - WordPress 'GDPR Cookie Consent Plugin' Stored Cross-Site Scripting Vulnerability