How to Fix a Critical 0-day WordPress Plugins Vulnerability (CVE-2021-24370) Found in Fancy Product Designer

The Wordfence Threat Intelligence team has discovered a critical 0-day WordPress plugins vulnerability (CVE-2021-24370) on May 31, 2021. This file upload vulnerability is being manipulated in the Fancy Product Designer, a WordPress plugin installed on over 17,000 websites. They discovered the vulnerability and reported the problem to the plugin’s developers on May 31. Although they have acknowledged the flaw and released a patched version 4.6.9 on June 2nd. In this post, we are going to tell about how to Fix a Critical authentication bypass 0-day WordPress Plugins Vulnerability (CVE-2021-24370) found in Fancy Product Designer.

 The team contacted the developers the same day and got a response within a day. They sent over the complete disclosure and received a response on June 1, 2021. Because of the vulnerability is being attacked actively, the team is disclosing it with minimal details until users update the patched version. It alerts the community to take precautions to keep the websites protected. 

As it’s a critical 0-day WordPress plugin vulnerability (CVE-2021-24370) under attack, it’s important to have a brief introduction to WordPress and its plugins.

What Is WordPress? What Is a WordPress Plugin?

WordPress is a free and open-source website creation platform. It’s a content management system (CMS) developed in PHP and uses a MYSQL database. WordPress is the most powerful and easiest website builder tool in existence today. 

A WordPress plugin is a bit of code that plugs into the self-hosted WordPress websites. It’s something that can add new functionality to your website or enhance the existing functionality on your website. Using plugins, you can make everything from small tweaks to large changes to your website. For example, a plugin can turn your simple website into an e-commerce store, forum, or social network.

What Is a Zero-Day Vulnerability?

A zero-day vulnerability is a flaw in a device or system that has been discovered but not patched yet. And an exploit that attacks a zero-day flaw is known as a zero-day exploit. These vulnerabilities were discovered before software developers, and security researchers got to know about them. Before issuing a patch, a zero-day vulnerability can pose a potential risk to users. Zero-day refers to the fact that software developers have zero days to resolve the issue that has been exposed and already exploited by the attackers.

Introducing Fancy Product Designer

Fancy Product Designer is a WordPress plugin that lets organizations provide customizable products to customers, allowing them to design items ranging from T-shirts to phone cases. It gives you the ability to upload PDF files and images that can be added to products. But unfortunately, the plugin has some checks in place to prevent malicious files from being uploaded. These checks were inadequate and could be bypassed easily. It allows hackers to upload the executable PHP files to any website with the plugin installed. Hackers can effectively gain Remote Code Execution on an affected site and allow a complete website takeover. 

How Are Attackers Abusing This 0-day WordPress Plugins Vulnerability (CVE-2021-24370)?

The hackers were exploiting the 0-day WordPress plugin vulnerability (CVE-2021-24370) to bypass authentication and allow unauthenticated users to log in to an account by entering the related username. It also allows users to create accounts using arbitrary roles, such as admin. These problems can occur even if the login widget is not active and the registration is disabled.

 WPScan, a web-hosting company, first reported the bug as a 0-day WordPress plugin vulnerability under active attack by hackers. As cyber criminals using the exploit in the wild, Wordfence noticed that IoC pointed to hackers creating privileged user accounts and using them to compromise the website. 

Researchers said that “We believe that hackers are adding accounts with usernames as registered email addresses depending on how the vulnerability creates accounts, and in some instances, installing a malicious plugin named ‘wpstaff‘ “. 

It means any website running this plugin is at risk, according to Wordfence posting.

Targets of This 0-day WordPress Plugins Vulnerability (CVE-2021-24370)

Fancy Product Designer, a famous WordPress plugin, is affected by the 0-day vulnerability. Additionally, researchers found vulnerabilities in WP Super Cache and Elementor that, if exploited successfully, attackers can take over a website and run arbitrary code on it. As of now the flaw has not been seen exploited in the wild.