Executive Summary

The vulnerability in the Gutenberg Blocks with AI by Kadence WP plugin for WordPress is a Server-Side Request Forgery (SSRF) issue affecting all versions up to and including 3.6.1. It arises because the plugin does not properly validate the 'endpoint' parameter in the GetResponse REST API handler's get_items() function.

Specifically, the permission check for accessing this endpoint only requires the 'edit_posts' capability, which is available to users with Contributor-level access or higher, instead of the more restrictive 'manage_options' capability typically reserved for Administrators.

This flaw allows authenticated users with Contributor-level permissions or above to make server-side requests to arbitrary endpoints on the configured GetResponse API server. As a result, they can retrieve sensitive data such as contacts, campaigns, and mailing lists using the site's stored API credentials. Additionally, the stored API key is leaked in the request headers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing users with relatively low-level permissions (Contributor role or higher) to access sensitive information stored on the GetResponse API server through the compromised WordPress site.

• Unauthorized retrieval of sensitive data such as contacts, campaigns, and mailing lists.
• Exposure of the site's stored API key in request headers, which could be used for further unauthorized API access.
• Potential misuse of the API credentials to manipulate or extract data from the GetResponse account linked to the site.

Overall, this can lead to data breaches, privacy violations, and unauthorized access to marketing or customer data.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by monitoring for unauthorized or suspicious REST API requests to the Kadence Blocks plugin's GetResponse API endpoint, specifically requests to the `/kb-getresponse/v1/get` route."}, {'type': 'paragraph', 'content': 'You can look for HTTP GET requests that include the `endpoint` parameter targeting the GetResponse API through the WordPress REST API. Since the vulnerability allows authenticated users with Contributor-level access or higher to make server-side requests, monitoring user roles making such requests can help detect exploitation attempts.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation attempts include:'}, {'type': 'list_item', 'content': 'Using web server logs (e.g., Apache or Nginx) to search for REST API calls to the vulnerable endpoint, for example:'}, {'type': 'list_item', 'content': 'grep "/wp-json/kb-getresponse/v1/get" /var/log/apache2/access.log'}, {'type': 'list_item', 'content': 'grep "/wp-json/kb-getresponse/v1/get" /var/log/nginx/access.log'}, {'type': 'list_item', 'content': 'Using WordPress CLI or database queries to identify users with Contributor or higher roles making REST API calls.'}, {'type': 'list_item', 'content': 'Monitoring outgoing HTTP requests from the server to the GetResponse API endpoints, which may indicate SSRF exploitation.'}] [3]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and recommended step to mitigate this vulnerability is to update the Kadence Blocks plugin to version 3.6.2 or later, which contains the security fixes addressing the SSRF issue.

Key mitigation measures included in the update are:

• Restricting API requests to a whitelist of allowed endpoints (`campaigns`, `tags`, and `custom-fields`), preventing arbitrary endpoint access.
• Enforcing stricter permission checks so that only users with the `manage_options` capability (typically administrators) can trigger server-side requests to the GetResponse API.
• Adding capability checks for media uploads to prevent lower-privileged users from uploading files.

If immediate updating is not possible, consider temporarily restricting access to the REST API endpoint `/kb-getresponse/v1/get` to administrator users only, or disabling the Kadence Blocks plugin until the update can be applied.

Useful 0 Not Useful 0