Unauthenticated Widget Area Manipulation in Premium Addons for KingComposer

Executive Summary

The Premium Addons for KingComposer plugin for WordPress has a vulnerability in versions up to and including 1.1.1. This vulnerability arises because the plugin lacks proper authorization and capability checks on two AJAX handlers: add_custom_sidebar() and remove_custom_sidebar(). These handlers are accessible via wp_ajax_nopriv_* hooks, allowing unauthenticated attackers to invoke them.

As a result, attackers can create arbitrary custom widget areas or delete existing custom sidebars by directly modifying the octagon_custom_sidebar option through update_option().

This unauthorized modification can cause widgets assigned to those custom sidebars to lose their registration silently and stop rendering on the website.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if your WordPress installation is running the Premium Addons for KingComposer plugin version 1.1.1 or earlier.

Since the vulnerability exploits unauthorized access to AJAX handlers exposed via wp_ajax_nopriv_* hooks, monitoring for unusual or unauthorized AJAX requests to add_custom_sidebar or remove_custom_sidebar endpoints can help detect exploitation attempts.

You can use network monitoring tools or web server logs to look for HTTP POST requests to admin-ajax.php with the action parameters 'add_custom_sidebar' or 'remove_custom_sidebar' coming from unauthenticated sources.

Example command to search web server logs for suspicious requests (assuming Apache logs):

• grep 'admin-ajax.php' /var/log/apache2/access.log | grep -E 'add_custom_sidebar|remove_custom_sidebar'

Additionally, inspecting the WordPress database option 'octagon_custom_sidebar' for unexpected changes or deletions of custom sidebars can indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to modify or delete custom widget areas on a WordPress site using the Premium Addons for KingComposer plugin.

The impact includes loss of data integrity for widget areas, as widgets assigned to deleted or altered sidebars will stop rendering without notice.

While this does not directly affect confidentiality or availability, it can degrade the user experience and site functionality by causing parts of the site to appear broken or incomplete.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized modification and loss of data by unauthenticated attackers through missing authorization checks in the Premium Addons for KingComposer plugin. However, there is no specific information provided about how this impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Premium Addons for KingComposer plugin to a version later than 1.1.1 where the authorization and capability checks on the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers are properly implemented.

If an update is not immediately available, consider temporarily disabling the vulnerable AJAX handlers or restricting access to admin-ajax.php to authenticated users only.

Additionally, monitor your WordPress installation for unauthorized changes to custom sidebars and restore any lost widgets or sidebars from backups if necessary.

Useful 0 Not Useful 0