Privilege Escalation Vulnerability Patches In ReviewX WordPress Plugin

Security researchers at Wordfence have identified a Privilege Escalation vulnerability in WPDeveloper’s ReviewX plugin, which is actively installed on more than 10,000 WordPress websites.

This vulnerability makes it possible for authenticated attackers to grant themselves administrative privileges via a user meta update.

Vulnerability Summary

The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the ‘rx_set_screen_options’ function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role via the ‘wp_screen_options[option]’ and ‘wp_screen_options[value]’ parameters during a screen option update.

Technical Analysis

ReviewX is a plugin that primarily enables customers to add ratings and reviews to WooCommerce stores, but it is also possible to use it with custom post types.

The reviews are listed on the WordPress admin page, which includes a screen option for how many reviews should be displayed per page for the admin user. Unfortunately, this feature was implemented insecurely, allowing all authenticated users to modify their capabilities, including granting themselves administrator capabilities.

Upon closer examination of the code, the ‘rx_set_screen_options’ function, which updates a user’s per-page screen option, is hooked to the ‘admin_init’ action.

This hook is triggered on every admin page without any post type or page restrictions. This means that the ‘rx_set_screen_options’ hooked function is invoked on all admin pages, allowing users who otherwise do not have access to the plugin to also access the function, as the function itself does not contain any restrictions.

This makes it possible for any authenticated user with an account, such as a subscriber, to invoke the ‘rx_set_screen_options’ function.

function rx_set_screen_options() {
    if ( isset( $_POST['wp_screen_options'] ) && is_array( $_POST['wp_screen_options'] ) ) {
        check_admin_referer( 'screen-options-nonce', 'screenoptionnonce' );
 
        $user = wp_get_current_user();
        if ( ! $user ) {
            return;
        }
         
        $option = $_POST['wp_screen_options']['option'];
        $value  = $_POST['wp_screen_options']['value'];
         
        if ( sanitize_key( $option ) != $option ) {
            return;
        }
 
        update_user_meta( $user->ID, $option, $value );
    }
}

The function includes a nonce check, but it uses a general nonce that is available on every admin page where there is a screen option.

The most significant problem and vulnerability are caused by the fact that there are no restrictions on the option, so the user’s metadata can be updated arbitrarily, and there is no sanitization on the option value, so any value can be set, including an array value, which is necessary for the capability meta option.

This made it possible for authenticated users, such as subscribers, to supply the ‘wp_capabilities’ array parameter with any desired capabilities, such as administrator, during a screen option update.

As with any Privilege Escalation vulnerability, this can be used for complete site compromise. Once an attacker has gained administrative user access to a WordPress site they can then manipulate anything on the targeted site as a normal administrator would. This includes the ability to upload plugin and theme files, which can be malicious zip files containing backdoors, and modifying posts and pages which can be leveraged to redirect site users to other malicious sites.

he vulnerability has been fully addressed in version 1.6.14 of the plugin.

We encourage WordPress users to verify that their sites are updated to the latest patched version of ReviewX.