Executive Summary

The Welcome Software Publishing plugin for WordPress has a vulnerability in all versions up to and including 0.0.31. This vulnerability arises because the nc_setOption() function, accessible via the nc.setOption XML-RPC method, lacks a proper authorization check. Although it verifies user credentials, it does not check if the user has the necessary permissions to manage options.

As a result, authenticated users with Subscriber-level access or higher can update arbitrary WordPress options through XML-RPC requests. This can be exploited to change the default user role to 'administrator' and create a new administrator account, leading to full privilege escalation and potential site takeover.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized privilege escalation and complete site takeover. An attacker with only Subscriber-level access can exploit this flaw to gain administrator privileges by modifying WordPress options and creating new administrator accounts.

Once an attacker has administrator access, they can control the entire WordPress site, potentially leading to data breaches, defacement, malware injection, or disruption of services.

Useful 0 Not Useful 0