Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability in a popular WordPress plugin allows anyone to create an administrator account on a website without needing any credentials, simply by visiting a page where the plugin is active. This could lead to a complete takeover of the affected website.
- Unauthenticated admin account creation is possible.
- It allows unauthorized control over websites.
- Confirm plugin relevance and exposure promptly.
Attack Path
How an attacker could exploit the issue
An attacker can create a new administrator account on a WordPress site by exploiting a vulnerability in the WP MAPS PRO plugin. This is possible because the plugin registers an unauthenticated AJAX action that can be triggered with a publicly available nonce. Once the administrator account is created, the attacker receives a magic-login URL that grants them full interactive administrative access to the site.
- Attacker needs public access to a WordPress site.
- Triggered by an unauthenticated AJAX request.
- Leads to full administrator account takeover.
Live Threat
Current exploitation, exposure, and threat context
A publicly accessible WordPress plugin feature can allow an unauthenticated attacker to create a new administrator account on the website. This is possible by exploiting a registered AJAX action that, when provided with a valid nonce found on any page using the plugin's map script, will unconditionally create the administrator account and return a magic-login URL for immediate access.
- Administrator accounts and site control.
- Unauthenticated AJAX action execution.
- Full site compromise.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
The WP MAPS PRO WordPress plugin's unauthenticated AJAX action can lead to the creation of an administrator account, posing a critical risk. Identifying where this plugin is deployed, confirming its reachability and business criticality, and then locating the accountable owner are the initial steps for remediation planning.
- Application owners should own this issue.
- Verify plugin usage and exposure.
- Plan remediation based on risk.
