Critical · published September 25, 2024
🚨 An unguarded gateway to total chaos! The updateUserInfo() function in the REST API TO MiniProgram plugin for WordPress lets anyone seize control of any user's account, including admins, with just a malicious tweak! 🔥 Think of this flaw like a restaurant with a reservation book that's left wide open — anyone can just scribble their name or even change someone else's reservation to their own, completely bypassing the host's checks. It's all about who gets to control the guest list! If an attacker exploits this vulnerability, they could change a user's email to one they control, such as a @weixin.com address. This allows them to reset the user's password and gain access to sensitive accounts, including those of site administrators — a recipe for absolute disaster!
Think of this flaw like a restaurant with a reservation book that's left wide open — anyone can just scribble their name or even change someone else's reservation to their own, completely bypassing the host's checks. It's all about who gets to control the guest list! This vulnerability arises from a lack of validation in the updateUserInfo() function, allowing unauthenticated attackers to manipulate the 'openid' user-controlled key and affect arbitrary user accounts without any authentication checks.
If an attacker exploits this vulnerability, they could change a user's email to one they control, such as a @weixin.com address. This allows them to reset the user's password and gain access to sensitive accounts, including those of site administrators — a recipe for absolute disaster! To protect your site, immediately update the REST API TO MiniProgram plugin to the latest version beyond 4.7.1. Additionally, review your plugins for any other security issues and ensure proper validation of user inputs to prevent privilege escalation. 🛡️ You've got this! Follow these steps and you'll slam the door on any potential attackers! 💪🌟