Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in a WordPress plugin used for managing notifications and one-time passwords in WooCommerce. This flaw allows unauthenticated attackers to potentially bypass login procedures and access any user account, including administrative ones, by knowing the target user's email address. The core issue involves the plugin inadvertently exposing a secret login token.
- Bypasses user logins for WordPress sites.
- Allows unauthorized access to any user account.
- Confirm plugin relevance and identify exposure.
Attack Path
How an attacker could exploit the issue
An attacker can bypass authentication by sending a request to a publicly accessible function that mistakenly reveals a secret login token in its response. If the attacker knows a target user's email address, they can use this token to log in as that user, potentially gaining administrative privileges.
- Requires knowledge of user's email.
- Publicly accessible OTP request.
- Full account takeover.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow unauthenticated attackers to bypass authentication and log in as any user on a WordPress site, provided they know the target user's email address. This is possible because a secret login token is exposed in the response to publicly accessible One-Time Password (OTP) requests, rather than being exclusively sent to the user's email.
- Site user accounts could be compromised.
- Attackers could exploit exposed OTP requests.
- Unauthorized access to any user's account.
Operational Fix
Recommended remediation, mitigation, and detection steps
For this WordPress plugin vulnerability, the application owner or the WordPress administrator is likely responsible for remediation. The first practical step is to identify all instances of the affected plugin on your WordPress sites, determine their exposure, and confirm the accountable owner. Following this, a risk-based plan for remediation can be developed, which may involve coordination with the plugin vendor.
- WordPress administrators own this issue.
- Verify plugin exposure and reachability.
- Plan vendor coordination or upgrade.
