Unauthenticated Arbitrary File Download in Premium Age Verification WordPress Plugin

Detection Guidance

This vulnerability allows unauthenticated attackers to download arbitrary files from websites using the Premium Age Verification / Restriction WordPress plugin version 3.0.2 or below.

To detect if your system is vulnerable, you can check the version of the Premium Age Verification / Restriction plugin installed on your WordPress site.

• Use WP-CLI to check the plugin version: wp plugin list --status=active
• Look for the plugin named 'premium-age-verification-restriction' and verify if its version is 3.0.2 or below.

To detect exploitation attempts on your network, monitor HTTP requests for suspicious patterns that attempt to download arbitrary files via the plugin.

• Use tools like grep or network monitoring to search web server logs for requests targeting the plugin's file download functionality.
• Example command to search Apache logs for suspicious requests: grep -i 'premium-age-verification' /var/log/apache2/access.log | grep -E 'download|file='
• Use intrusion detection systems or web application firewalls with rules to detect or block arbitrary file download attempts related to this plugin.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the WordPress Premium Age Verification / Restriction plugin, versions 3.0.2 and below. It is an Arbitrary File Download issue that allows unauthenticated attackers to download any file from the affected website.

This flaw can expose sensitive data such as login credentials or backup files without requiring any authentication.

The vulnerability is classified as high severity with a CVSS score of 7.5 and falls under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by allowing attackers to download sensitive files from your website.

• Exposure of sensitive data such as login credentials.
• Access to backup files or other confidential information stored on the server.

Such data exposure can lead to further attacks, data breaches, or unauthorized access to your systems.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects Premium Age Verification / Restriction plugin versions 3.0.2 and below, allowing unauthenticated arbitrary file downloads.

Immediate mitigation steps include updating the plugin to a non-vulnerable version once available or applying temporary mitigation rules issued by Patchstack to block attacks.

If an update is not yet available, seek assistance from your hosting provider or a developer to implement these temporary protections.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to download any file from the affected website, potentially exposing sensitive data such as login credentials or backup files.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information.

Organizations using the affected plugin versions may face increased risk of data breaches, which can result in regulatory penalties and loss of trust.

Useful 0 Not Useful 0