CVE-2014-125104 (published 2023-06-01T13:15Z)

A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patch is named e3b92b14edca6291c5f998d54c90cbe98a1fb0e3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230263.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/vaultpress
commit_details: repo_url: https://github.com/wp-plugins/vaultpress
author: briancolinger
author_date: 2014-07-01 21:52:10+00:00
msg: Adding a new hotfix for the MailPoet (wysija-newsletters) Remote File Upload vulnerability.


git-svn-id: https://plugins.svn.wordpress.org/vaultpress/trunk@941846 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/vaultpress
repo_name: wp-plugins/vaultpress
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: class.vaultpress-hotfixes.php
change_type: ModificationType.MODIFY
diff: @@ -85,6 +85,9 @@ class VaultPress_Hotfixes {
 
 		// Protect All-in-one SEO from non-authorized users making changes, and script injection attacks.          
 		add_action( 'wp_ajax_aioseop_ajax_save_meta', array( $this, 'protect_aioseo_ajax' ), 1 );
+
+		// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
+		add_action( 'admin_init', array( $this , 'protect_wysija_newsletters_verify_capability' ), 1 );
 	}
 
 	function disable_jetpack_xmlrpc_methods_293( $jetpack_methods, $core_methods, $user = false ) {
@@ -574,6 +577,45 @@ EOD;
 		// Strip tags from the metadata value.
 		$_POST['new_meta'] = strip_tags( $_POST['new_meta'] );
 	}
+
+	// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
+	function protect_wysija_newsletters_verify_capability() {
+		if ( !class_exists( 'WYSIJA_object' ) )
+			return true;
+		if ( version_compare( WYSIJA::get_version(), '2.6.7', '>=' ) )
+			return true;
+		if ( !defined( 'DOING_AJAX' ) && !defined( 'WYSIJA_ITF' ) )
+			return true;
+        if( isset( $_REQUEST['page'] ) && substr( $_REQUEST['page'] ,0 ,7 ) == 'wysija_' ){
+
+            switch( $_REQUEST['page'] ){
+                case 'wysija_campaigns':
+                    $role_needed = 'wysija_newsletters';
+                    break;
+                case 'wysija_subscribers':
+                    $role_needed = 'wysija_subscribers';
+                    break;
+                case 'wysija_config':
+                    $role_needed = 'wysija_config';
+                    break;
+                case 'wysija_statistics':
+                    $role_needed = 'wysija_stats_dashboard';
+                    break;
+                default:
+                    $role_needed = 'switch_themes';
+            }
+
+            if( current_user_can( $role_needed ) ){
+                return true;
+            } else{
+                die( 'You are not allowed here.' );
+            }
+
+        }else{
+            // this is not a wysija interface/action we can let it pass
+            return true;
+        }
+    }
 }
 
 global $wp_version;

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ Contributors: automattic, apokalyptik, briancolinger, josephscott, shaunandrews,
 Tags: security, malware, virus, backups, scanning
 Requires at least: 2.9.2
 Tested up to: 3.9.1
-Stable tag: 1.6
+Stable tag: 1.6.1
 License: GPLv2
 
 VaultPress is a subscription service offering realtime backup, automated security scanning, and support from WordPress experts.
@@ -51,6 +51,9 @@ A VaultPress subscription is for a single WordPress site. You can purchase addit
 Yes, VaultPress supports Multisite installs. Each site will require its own subscription.
 
 == Changelog ==
+= 1.6.1 =
+* Security: Add a new security hotfix.
+
 = 1.6 =
 * Bugfix: Better handling for Multisite table prefixes.
 * Bugfix: Do not use the deprecated wpdb::escape() method.

programming_language: Markdown
filename: vaultpress.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
  * Plugin Name: VaultPress
  * Plugin URI: http://vaultpress.com/?utm_source=plugin-uri&amp;utm_medium=plugin-description&amp;utm_campaign=1.0
  * Description: Protect your content, themes, plugins, and settings with <strong>realtime backup</strong> and <strong>automated security scanning</strong> from <a href="http://vaultpress.com/?utm_source=wp-admin&amp;utm_medium=plugin-description&amp;utm_campaign=1.0" rel="nofollow">VaultPress</a>. Activate, enter your registration key, and never worry again. <a href="http://vaultpress.com/help/?utm_source=wp-admin&amp;utm_medium=plugin-description&amp;utm_campaign=1.0" rel="nofollow">Need some help?</a>
- * Version: 1.6
+ * Version: 1.6.1
  * Author: Automattic
  * Author URI: http://vaultpress.com/?utm_source=author-uri&amp;utm_medium=plugin-description&amp;utm_campaign=1.0
  * License: GPL2+
@@ -18,7 +18,7 @@ if ( !defined( 'ABSPATH' ) )
 class VaultPress {
 	var $option_name    = 'vaultpress';
 	var $db_version     = 3;
-	var $plugin_version = '1.6';
+	var $plugin_version = '1.6.1';
 
 	function __construct() {
 		register_activation_hook( __FILE__, array( $this, 'activate' ) );

programming_language: PHP