{"id":222369,"date":"2021-10-22T16:33:40","date_gmt":"2021-10-22T14:33:40","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=222369"},"modified":"2021-10-22T16:33:40","modified_gmt":"2021-10-22T14:33:40","slug":"petit-chelem-de-cves-wordpress-plugins-vulnerables","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/","title":{"rendered":"A small slam of WordPress CVEs: vulnerable plugins"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Trois vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans des <em>plugins<\/em> WordPress impactant plus de 100,000 applications Web ont r\u00e9cemment \u00e9t\u00e9 d\u00e9couvertes au sein du p\u00f4le \u00c9valuation d\u2019Intrinsec. Ces d\u00e9fauts de s\u00e9curit\u00e9 permettent \u00e0 des attaquants de r\u00e9aliser diff\u00e9rentes attaques&nbsp;: l\u2019un permet d\u2019effectuer des injections SQL pouvant conduire \u00e0 la suppression de fichiers arbitraires, un autre des attaques de type XSS, et le dernier, d\u2019exploiter des d\u00e9fauts d&rsquo;autorisation menant \u00e0 l&rsquo;usurpation d&rsquo;identit\u00e9 bancaire.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/justin-morgan-I3jsaLiK_sc-unsplash-2-1024x683.jpg\" alt=\"\" class=\"wp-image-222385\" width=\"466\" height=\"305\"\/><figcaption><em>Un plugin WordPress est un module additionnel pouvant \u00e9tendre les fonctionnalit\u00e9s d&rsquo;une application Web bas\u00e9e sur WordPress<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u00c0 l&rsquo;issue de ces d\u00e9couvertes de vuln\u00e9rabilit\u00e9s, le CERT d&rsquo;Intrinsec a communiqu\u00e9 les <em>advisories<\/em> (disponibles ci-dessous) aux \u00e9diteurs de <em>plugins<\/em> ainsi qu&rsquo;\u00e0 WordPress et WordFence. Le traitement de ces avis a conduit \u00e0 l&rsquo;obtention de trois num\u00e9ros de CVE faisant l\u2019objet de cet article. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inscrites dans les cat\u00e9gories \u00ab&nbsp;Injection&nbsp;\u00bb et \u00ab&nbsp;Broken Access Control&nbsp;\u00bb du <a href=\"https:\/\/owasp.org\/Top10\/en\/\">Top 10 OWASP 2021<\/a>, ces vuln\u00e9rabilit\u00e9s refl\u00e8tent ce que l&rsquo;on retrouve dans le cadre de prestations de tests d&rsquo;intrusion. Ce type de mission s&rsquo;inscrit dans les activit\u00e9s de tests d&rsquo;intrusion externe du p\u00f4le \u00c9valuation o\u00f9 des applications bas\u00e9es sur des <a href=\"https:\/\/www.intrinsec.com\/comission-whitebox-cms-analysis\/\">CMS<\/a> comme WordPress sont r\u00e9guli\u00e8rement audit\u00e9es. La r\u00e9alisation des tests techniques suit le Testing Guide de l&rsquo;OWASP enrichi d&rsquo;une m\u00e9thodologie sp\u00e9cifique aux CMS et d&rsquo;outils, d\u00e9velopp\u00e9s en interne, propres \u00e0 l&rsquo;\u00e9valuation d\u2019application bas\u00e9es sur des CMS en bo\u00eete blanche, c\u2019est-\u00e0-dire avec un acc\u00e8s complet au code source. Ce cocktail unique permet aux consultants d&rsquo;analyser en profondeur le niveau de s\u00e9curit\u00e9 de ces applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-d-une-injection-sql-la-suppression-de-fichiers-arbitraires\">D&rsquo;une injection SQL \u00e0 la suppression de fichiers arbitraires<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Plugin :<\/strong> <a href=\"https:\/\/wordpress.org\/plugins\/wp-bannerize\/\" target=\"_blank\" rel=\"noreferrer noopener\">WP-Bannerize<\/a><\/li><li><strong>CVE ID :<\/strong> CVE-2021-3951<\/li><li><strong>CWE&nbsp;:<\/strong> CWE-89<\/li><li><strong>MITRE ATT&amp;CK : <\/strong><a href=\"https:\/\/attack.mitre.org\/techniques\/T1561\/001\/\" target=\"_blank\" rel=\"noreferrer noopener\">T1561<\/a>, <a href=\"https:\/\/attack.mitre.org\/techniques\/T1190\/\" target=\"_blank\" rel=\"noreferrer noopener\">T1190<\/a>, <a href=\"https:\/\/attack.mitre.org\/techniques\/T1005\/\" target=\"_blank\" rel=\"noreferrer noopener\">T1005<\/a><\/li><li><strong>Advisory :<\/strong> <a href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/ISEC-V2021-02.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Cliquez ici<\/a><\/li><li><strong>Recommandation : <\/strong>D\u00e9sinstaller le <em>plugin<\/em><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">L&rsquo;extension WP-Bannerize permet d&rsquo;ajouter des banni\u00e8res aux pages d&rsquo;une application. Cependant, la gestion des banni\u00e8res est vuln\u00e9rable \u00e0 des injections SQL. Les fonctions affect\u00e9es correspondent aux actions de modification d&rsquo;une banni\u00e8re (fonction \u00ab updateBannerFromLocal \u00bb dans le code source de l\u2019extension), de leur d\u00e9placement dans la corbeille (\u00ab setBannerToTrash \u00bb), de leur r\u00e9cup\u00e9ration depuis la corbeille (\u00ab unsetBannerToTrash \u00bb), et de leur suppression d\u00e9finitive (\u00ab deleteBanner \u00bb). Elles pr\u00e9sentent le m\u00eame d\u00e9faut&nbsp;: l\u2019absence de filtre pour l\u2019entr\u00e9e utilisateur \u00ab&nbsp;id&nbsp;\u00bb. Ce vecteur d\u2019attaque permet \u00e0 un utilisateur malveillant d\u2019injecter du code afin de modifier le comportement de la requ\u00eate SQL. L\u2019extrait de code ci-dessous, correspondant \u00e0 la fonction \u00ab updateBannerFromLocal \u00bb appel\u00e9e lors de la mise \u00e0 jour d\u2019une banni\u00e8re, illustre cette vuln\u00e9rabilit\u00e9 o\u00f9 le param\u00e8tre POST \u00ab&nbsp;id&nbsp;\u00bb est inclu dans la requ\u00eate SQL ligne 5 sans \u00eatre filtr\u00e9. Ce comportement est similaire \u00e0 celui des autres fonctions vuln\u00e9rables \u00e9nonc\u00e9es.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/01code-1-1024x250.png\" alt=\"\" class=\"wp-image-222419\" width=\"1008\" height=\"246\"\/><figcaption><em>Extrait de \u00ab\u00a0Classes\/wpBannerizeAdmin.php\u00a0\u00bb &#8211; fonction \u00ab\u00a0updateBannerFromLocal\u00a0\u00bb<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><br> L&rsquo;exploitation de ce type de vuln\u00e9rabilit\u00e9 pourrait notamment conduire \u00e0 la compromission de la confidentialit\u00e9 de la base de donn\u00e9es de l&rsquo;application. Cependant, il est possible d\u2019aller plus loin. En effet, la fonction appel\u00e9e lors de la suppression d\u00e9finitive d\u2019une banni\u00e8re, \u00ab deleteBanner \u00bb, dont le code figure ci-dessous, comporte deux requ\u00eates SQL aux lignes 5 et 7, chacune employant la m\u00eame entr\u00e9e utilisateur non filtr\u00e9e \u00ab&nbsp;id&nbsp;\u00bb vue pr\u00e9c\u00e9demment. Lorsque la premi\u00e8re requ\u00eate retourne 1, la condition \u00e0 la ligne 6 est v\u00e9rifi\u00e9e et la deuxi\u00e8me requ\u00eate SQL est \u00e0 son tour ex\u00e9cut\u00e9e, ligne 7&nbsp;; son r\u00e9sultat est ensuite pass\u00e9 en argument \u00e0 la fonction de suppression de fichier \u00ab unlink&nbsp;\u00bb ligne 8.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/02code-1-1024x337.png\" alt=\"\" class=\"wp-image-222420\" width=\"1003\" height=\"335\"\/><figcaption><em>Extrait de <\/em>\u00ab\u00a0<em>Classes\/wpBannerizeAdmin.php\u00a0\u00bb &#8211; fonction \u00ab\u00a0deleteBanner\u00a0\u00bb<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Ainsi, en parvenant \u00e0 concevoir un code malveillant retournant la valeur 1 avec la premi\u00e8re requ\u00eate puis le chemin d\u2019un fichier choisi par l\u2019attaquant avec la deuxi\u00e8me, ce dernier serait alors supprim\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dans le cadre de la preuve de concept, l\u2019\u00e9laboration du code malveillant \u00e0 injecter a suivi le raisonnement suivant&nbsp;:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>En injectant une unique charge malveillante (<em>payload<\/em>) il faut obtenir deux valeurs diff\u00e9rentes&nbsp;;<\/li><li>Une diff\u00e9rence identifi\u00e9e entre les deux requ\u00eates SQL o\u00f9 la <em>payload<\/em> est inject\u00e9e est le moment d\u2019ex\u00e9cution&nbsp;;<\/li><li>Suivant le moment o\u00f9 une requ\u00eate est ex\u00e9cut\u00e9e, son comportement peut \u00eatre adapt\u00e9&nbsp;: si la date d\u2019ex\u00e9cution est inf\u00e9rieure \u00e0 une date donn\u00e9e, alors un comportement A est ex\u00e9cut\u00e9, sinon un comportement B est&nbsp;effectu\u00e9 ;<\/li><li>L\u2019\u00e9cart de temps entre l\u2019ex\u00e9cution des deux requ\u00eates peut \u00eatre contr\u00f4l\u00e9 par la fonction SQL \u00ab&nbsp;sleep&nbsp;\u00bb.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Cette r\u00e9flexion a abouti au r\u00e9sultat suivant&nbsp;: lors de la requ\u00eate POST de l\u2019attaquant \u00e0 T<sub>0<\/sub>, une date de r\u00e9f\u00e9rence T<sub>ref<\/sub> est fix\u00e9e 2 secondes dans le futur et le code SQL malveillant comporte la condition suivante&nbsp;:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Si la date actuelle T est ant\u00e9rieure \u00e0 T<sub>ref<\/sub>, alors une pause de 4 secondes est effectu\u00e9e et la valeur 1 est retourn\u00e9e&nbsp;;<\/li><li>Sinon (date actuelle T post\u00e9rieure \u00e0 T<sub>ref<\/sub>) le chemin du fichier \u00e0 supprimer est retourn\u00e9.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/sqli.png\" alt=\"D\u00e9tail de l'exploitation de l'injection SQL menant \u00e0 la suppression d'un fichier\" class=\"wp-image-222372\"\/><figcaption><em>D\u00e9tail de l&rsquo;exploitation de l&rsquo;injection SQL menant \u00e0 la suppression d&rsquo;un fichier<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">L\u2019int\u00e9r\u00eat de cette faille est double pour un attaquant : il est possible d\u2019extraire du contenu de la base de donn\u00e9es de l\u2019application en tant qu\u2019utilisateur authentifi\u00e9 disposant d\u2019un acc\u00e8s au tableau de bord, mais \u00e9galement de supprimer des fichiers sur lesquels l\u2019utilisateur propri\u00e9taire du service Web dispose des droits. La suppression de fichiers peut notamment rendre le site indisponible et conduire \u00e0 un d\u00e9ni de service ou encore, peut permettre de contourner des restrictions d\u2019autorisation en supprimant le fichier \u00ab .htaccess \u00bb dans le cas d\u2019un serveur Apache par exemple, qui d\u00e9finit certaines propri\u00e9t\u00e9s d\u2019accessibilit\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-xss-r-fl-chie-sur-le-tableau-de-bord-administrateur\">XSS R\u00e9fl\u00e9chie sur le tableau de bord administrateur<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Plugin&nbsp;:<\/strong> <a href=\"https:\/\/fr.wordpress.org\/plugins\/fv-wordpress-flowplayer\/\" target=\"_blank\" rel=\"noreferrer noopener\">FV Flowplayer Video Player<\/a><\/li><li><strong>CVE ID&nbsp;:<\/strong> CVE-2021-39250<\/li><li><strong>CWE&nbsp;:<\/strong> CWE-79<\/li><li><strong>MITRE ATT&amp;CK&nbsp;: <\/strong><a href=\"https:\/\/attack.mitre.org\/techniques\/T1190\/\" target=\"_blank\" rel=\"noreferrer noopener\">T1190<\/a><\/li><li><strong>Advisory&nbsp;:<\/strong> <a href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/ISEC-V2021-03.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Cliquez ici<\/a><\/li><li><strong>Recommandation : <\/strong>Mettre \u00e0 jour le <em>plugin<\/em> (version \u2265 7.5.3.727)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Le <em>plugin<\/em> FV Flowplayer Video Player permet d&rsquo;inclure des vid\u00e9os dans les pages d&rsquo;une application. Une fonctionnalit\u00e9 de statistiques est disponible sur le tableau de bord des administrateurs page <em>fv_player_stats<\/em>, cependant cette derni\u00e8re est vuln\u00e9rable \u00e0 des attaques de type XSS r\u00e9fl\u00e9chies.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/03code-1-1024x294.png\" alt=\"\" class=\"wp-image-222421\"\/><figcaption><em>Extrait de <\/em>\u00ab\u00a0<em>view\/stats.php<\/em>\u00ab\u00a0<\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">En effet, le param\u00e8tre GET \u00ab&nbsp;player_id&nbsp;\u00bb est utilis\u00e9 sans v\u00e9rification ni filtrage de son contenu ligne 7. Un attaquant pourrait alors injecter du code javascript arbitraire qui serait int\u00e9gr\u00e9 dans le code HTML de la page g\u00e9n\u00e9r\u00e9 par le serveur puis ex\u00e9cut\u00e9 sur le navigateur de la victime. Cependant il est n\u00e9cessaire que la variable \u00ab&nbsp;fv_single_player_stats_data&nbsp;\u00bb soit d\u00e9finie pour remplir la condition ligne 4 et atteindre la ligne vuln\u00e9rable 7. Les contraintes \u00e0 respecter dict\u00e9es ligne 1 pour que cette variable soit d\u00e9finie sont :<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>Le param\u00e8tre GET \u00ab&nbsp;player_id&nbsp;\u00bb doit exister ;<\/li><li>La valeur du param\u00e8tre GET \u00ab&nbsp;player_id&nbsp;\u00bb doit \u00eatre telle que la fonction intval($_GET[&lsquo;player_id&rsquo;]) renvoie une valeur non nulle.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Cette deuxi\u00e8me contrainte fait appel \u00e0 la fonction \u00ab intval \u00bb qui convertit son argument en valeur num\u00e9rique enti\u00e8re. Pour que celle-ci soit valid\u00e9e, c&rsquo;est-\u00e0-dire que la valeur retourn\u00e9e soit diff\u00e9rente de 0, il suffit que la cha\u00eene pass\u00e9e en argument commence par un chiffre. La valeur num\u00e9rique retourn\u00e9e par \u00ab intval \u00bb sera celle du nombre qui pr\u00e9fixe la cha\u00eene de caract\u00e8res. Si la cha\u00eene pass\u00e9e en argument comporte du code HTML, celui-ci sera alors ins\u00e9r\u00e9 ligne 7 et interpr\u00e9t\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/xss-1024x101.png\" alt=\"D\u00e9tail de l'exploitation de la XSS\" class=\"wp-image-222375\"\/><figcaption><em>D\u00e9tail de l&rsquo;exploitation de la XSS<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Un attaquant pourrait ainsi g\u00e9n\u00e9rer un lien comportant une charge malveillante au niveau de l\u2019entr\u00e9e \u00ab&nbsp;player_id \u00bb,&nbsp;qui s\u2019ex\u00e9cuterait sur le navigateur de la victime ayant cliqu\u00e9 sur le lien. Les cibles de cette attaque sont les utilisateurs administrateurs \u00e9tant les seuls \u00e0 disposer d\u2019un acc\u00e8s \u00e0 la page des statistiques de ce <em>plugin<\/em>. Le code malveillant pourrait engendrer, \u00e0 l\u2019insu de la victime, la r\u00e9alisation d\u2019actions d\u2019administration comme la cr\u00e9ation d\u2019un compte administrateur par exemple.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-d-faut-d-autorisation-menant-l-usurpation-d-identit-bancaire\">D\u00e9faut d&rsquo;autorisation menant  \u00e0 l&rsquo;usurpation d&rsquo;identit\u00e9 bancaire<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Plugin&nbsp;:<\/strong> <a href=\"https:\/\/wordpress.org\/plugins\/woo-stripe-payment\/\" target=\"_blank\" rel=\"noreferrer noopener\">Stripe For WooCommerce<\/a> <\/li><li><strong>CVE ID&nbsp;:<\/strong> CVE-2021-39347<\/li><li><strong>CWE&nbsp;:<\/strong> CWE-284<\/li><li><strong>MITRE ATT&amp;CK&nbsp;: <\/strong><a href=\"https:\/\/attack.mitre.org\/techniques\/T1190\/\" target=\"_blank\" rel=\"noreferrer noopener\">T1190<\/a>, <a href=\"https:\/\/attack.mitre.org\/techniques\/T1565\/001\/\" target=\"_blank\" rel=\"noreferrer noopener\">T1565.001<\/a><\/li><li><strong>Advisory&nbsp;:<\/strong> <a href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/ISEC-V2021-04.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Cliquez ici<\/a><\/li><li><strong>Recommandation : <\/strong>Mettre \u00e0 jour le <em>plugin <\/em>(version \u2265 3.3.10)<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Le <em>plugin<\/em> Stripe For WooCommerce permet d&rsquo;enrichir l&rsquo;offre des m\u00e9thodes de paiements pour les sites de e-commerces bas\u00e9s sur WooCommerce. Cependant un manque de v\u00e9rification des <em>capabilities<\/em> permet \u00e0 tout utilisateur authentifi\u00e9 de configurer son propre identifiant \u00ab&nbsp;customer_id&nbsp;\u00bb. En effet, lorsque qu\u2019un utilisateur met \u00e0 jour les donn\u00e9es de son profil, la fonction vuln\u00e9rable \u00ab&nbsp;save \u00bb , dont un extrait figure ci-dessous,&nbsp;est appel\u00e9e.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/04code-1-1024x793.png\" alt=\"\" class=\"wp-image-222423\"\/><figcaption><em>Extrait de \u00ab\u00a0\/admin\/class-wc-stripe-admin-user-edit.php\u00a0\u00bb<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Le \u00ab&nbsp;customer_id&nbsp;\u00bb d\u2019un utilisateur correspond \u00e0 l\u2019identifiant utilis\u00e9 pour Stripe et est stock\u00e9 dans les param\u00e8tres du compte WordPress&nbsp;; un utilisateur sauvegardant des m\u00e9thodes de paiement sur l\u2019application WordPress pourra alors faire appel \u00e0 celles-ci lors d\u2019un paiement sans entrer \u00e0 nouveau leurs informations. Quant au \u00ab&nbsp;user_id&nbsp;\u00bb, il s\u2019agit de l\u2019identifiant WordPress de l\u2019utilisateur. La fonction \u00ab&nbsp;save&nbsp;\u00bb permet notamment de modifier la valeur du \u00ab&nbsp;customer_id&nbsp;\u00bb pour son propre \u00ab&nbsp;user_id&nbsp;\u00bb, except\u00e9 pour les administrateurs pouvant \u00e9galement modifier les profils des autres utilisateurs. Lors d\u2019une modification de l\u2019identifiant Stripe, la fonction \u00ab&nbsp;save&nbsp;\u00bb appelle la fonction&nbsp;\u00ab&nbsp;wc_stripe_save_customer&nbsp;\u00bb&nbsp;ligne 12 pour mettre \u00e0 jour la valeur ainsi que la fonction \u00ab&nbsp;WC_Stripe_Customer_Manager::sync_payment_methods&nbsp;\u00bb&nbsp;ligne 27 pour synchroniser les moyens de paiement associ\u00e9s \u00e0 ce compte.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Toutefois, aucune v\u00e9rification au niveau des <em>capabilites<\/em> d\u2019un utilisateur n\u2019est effectu\u00e9e durant l\u2019action de mise \u00e0 jour de l\u2019identifiant Stripe. Un attaquant pourrait alors modifier son propre identifiant \u00ab&nbsp;customer_id&nbsp;\u00bb. En rempla\u00e7ant cet identifiant par celui d\u2019un autre utilisateur, trouv\u00e9 \u00e0 l\u2019aide d\u2019autres attaques, il acc\u00e9derait aux m\u00e9thodes de paiement enregistr\u00e9es par l&rsquo;utilisateur l\u00e9gitimement li\u00e9 \u00e0 ce \u00ab&nbsp;customer_id&nbsp;\u00bb lors de son prochain paiement.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" src=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2021\/10\/defauth.png\" alt=\"Impact de l'exploitation de la vuln\u00e9rabilit\u00e9\" class=\"wp-image-222377\"\/><figcaption><em>R\u00e9sultat de l&rsquo;exploitation de la vuln\u00e9rabilit\u00e9<\/em><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">L&rsquo;exploitation de cette vuln\u00e9rabilit\u00e9 impacterait n\u00e9gativement l&rsquo;image de marque de l&rsquo;entreprise de e-commerce, et impliquerait \u00e9galement une perte de confidentialit\u00e9 et d&rsquo;int\u00e9grit\u00e9 des donn\u00e9es.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pour plus d&rsquo;informations sur les prestations de tests d\u2019intrusion externe, <a href=\"https:\/\/www.intrinsec.com\/contactez-nous\/\">contactez-nous<\/a> !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Article \u00e9crit par @Margaux Dabert, Consultante S\u00e9curit\u00e9 chez <a href=\"http:\/\/www.intrinsec.com\">Intrinsec<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trois vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans des plugins WordPress impactant plus de 100,000 applications Web ont r\u00e9cemment [&hellip;]<\/p>\n","protected":false},"author":38,"featured_media":222385,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-222369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-evaluation-securite"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables - INTRINSEC<\/title>\n<meta name=\"description\" content=\"Trois vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans des plugins WordPress impactant plus de 100,000 applications Web d\u00e9couvertes au sein du p\u00f4le \u00c9valuation d\u2019Intrinsec.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables\" \/>\n<meta property=\"og:description\" content=\"Trois vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans des plugins WordPress impactant plus de 100,000 applications Web d\u00e9couvertes au sein du p\u00f4le \u00c9valuation d\u2019Intrinsec.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-22T14:33:40+00:00\" \/>\n<meta name=\"author\" content=\"Margaux Dabert\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Margaux Dabert\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/\"},\"author\":{\"name\":\"Margaux Dabert\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/15304758ef548790a716c99505e6d056\"},\"headline\":\"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables\",\"datePublished\":\"2021-10-22T14:33:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/\"},\"wordCount\":1860,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"articleSection\":[\"S\u00e9curit\u00e9 offensive &amp; Audit\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/\",\"name\":\"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2021-10-22T14:33:40+00:00\",\"description\":\"Trois vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans des plugins WordPress impactant plus de 100,000 applications Web d\u00e9couvertes au sein du p\u00f4le \u00c9valuation d\u2019Intrinsec.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/petit-chelem-de-cves-wordpress-plugins-vulnerables\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/15304758ef548790a716c99505e6d056\",\"name\":\"Margaux Dabert\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Margaux Dabert\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/margaux-dabert\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"WordPress CVEs: Vulnerable Plugins - INTRINSEC","description":"Three vulnerabilities in WordPress plugins impacting more than 100,000 web applications discovered within Intrinsec&#039;s Evaluation division.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/","og_locale":"en_US","og_type":"article","og_title":"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables","og_description":"Trois vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans des plugins WordPress impactant plus de 100,000 applications Web d\u00e9couvertes au sein du p\u00f4le \u00c9valuation d\u2019Intrinsec.","og_url":"https:\/\/www.intrinsec.com\/en\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/","og_site_name":"INTRINSEC","article_published_time":"2021-10-22T14:33:40+00:00","author":"Margaux Dabert","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Margaux Dabert","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/"},"author":{"name":"Margaux Dabert","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/15304758ef548790a716c99505e6d056"},"headline":"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables","datePublished":"2021-10-22T14:33:40+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/"},"wordCount":1860,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#primaryimage"},"thumbnailUrl":"","articleSection":["S\u00e9curit\u00e9 offensive &amp; Audit"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/","url":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/","name":"WordPress CVEs: Vulnerable Plugins - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#primaryimage"},"thumbnailUrl":"","datePublished":"2021-10-22T14:33:40+00:00","description":"Three vulnerabilities in WordPress plugins impacting more than 100,000 web applications discovered within Intrinsec&#039;s Evaluation division.","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/petit-chelem-de-cves-wordpress-plugins-vulnerables\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"Petit Chelem de CVEs WordPress : plugins vuln\u00e9rables"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/15304758ef548790a716c99505e6d056","name":"Margaux Dabert","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Margaux Dabert"},"url":"https:\/\/www.intrinsec.com\/en\/author\/margaux-dabert\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/222369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=222369"}],"version-history":[{"count":0,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/222369\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=222369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=222369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=222369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}