WooCommerce – Store Toolkit [Privilege Escalation]

Description

The plugin “WooCommerce – Store Toolkit” for WordPress suffers from a privilege escalation vulnerability.

An attacker must have a valid user account which is possible simply by registering to the infected website. This is possible because this plugin must be installed in a website with WooCommerce plugin to be any of use. Since WooCommerce is an e-store plugin allows user registration by default, so we assume that all websites that have the “WooCommerce – Store Toolkit” plugin are also open to user registration.

As long as an attacker have an active account at the infected website he can perform the attack at ease because no action validation is taking place from the “WooCommerce – Store Toolkit” plugin. The “WooCommerce – Store Toolkit” plugin is designed to perform a set of actions like:

  • Permanently delete all posts, post categories and post tags
  • Permanently delete all media (attachments)
  • Permanently delete all products, product categories, product tags and attributes
  • Permanently delete all orders
  • Permanently delete all comments

All these actions they normally require administrative wrights. But in this case any registered user can perform these actions, even with the most limited wrights, therefor this issue is considered as an Privilege Escalation vulnerability.

PoC

The following script will nuke nearly all site content from example.com using the account with username:username and password:password. This has to be an already registered account for this to work.

Solution

Upgrade to v1.5.7