Executive Summary

This vulnerability in the Secure Passkeys WordPress plugin allows authenticated users with Subscriber-level access or higher to view and delete passkeys due to missing capability checks on certain functions (delete_passkey() and passkeys_list()). Essentially, the plugin did not properly verify if a user had the right permissions before allowing these sensitive actions, enabling unauthorized access to passkeys. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized users with low-level access viewing and deleting passkeys, which are used for authentication. This could compromise user accounts by allowing attackers to remove or manipulate authentication credentials, potentially leading to privilege escalation or account takeover. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the WordPress site is running the Secure Passkeys plugin version 1.2.1 or earlier, as these versions lack proper permission checks. You can verify the plugin version via the WordPress admin dashboard or by inspecting the plugin files. Additionally, monitoring for unauthorized AJAX POST requests to the plugin's endpoints (such as secure-passkeys-adminarea-ajax.php or secure-passkeys-frontend-ajax.php) from users with Subscriber-level access or above may indicate exploitation attempts. Specific commands to check plugin version on the server include: 1) Using WP-CLI: `wp plugin list | grep secure-passkeys` to see the installed version. 2) Searching web server logs for suspicious POST AJAX requests to the plugin's PHP files, e.g., `grep 'POST.*secure-passkeys' /var/log/apache2/access.log` or equivalent. However, no explicit detection commands are provided in the resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Secure Passkeys WordPress plugin to version 1.2.2 or later, which includes enhanced permission checks and fixes the vulnerability. This update enforces strict access control, nonce verification, and capability checks to prevent unauthorized users from viewing or deleting passkeys. Until the update is applied, restrict access to users with higher privileges and monitor for suspicious activity related to passkey management endpoints. [1]

Useful 0 Not Useful 0