Privilege Escalation in WP Fusion (Pro) WordPress Plugin

Executive Summary

The WP Fusion (Pro) plugin for WordPress has a privilege escalation vulnerability in versions up to 3.47.13. It allows authenticated attackers with Subscriber-level access or higher to create a new user account with administrator privileges by exploiting insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler. The access_key required for exploitation is shared with ThriveCart customers during setup, making it accessible to attackers.

Useful 0 Not Useful 0

Detection Guidance

Check if the ThriveCart Auto Login option is enabled in WP Fusion settings. Inspect WordPress user accounts for unexpected administrator role assignments. Review server logs for unusual role parameter modifications in ThriveCart Auto Login URLs.

Useful 0 Not Useful 0

Impact Analysis

If you use the WP Fusion (Pro) plugin with ThriveCart Auto Login enabled, an attacker could gain full control of your WordPress site. They could create an admin account, modify site settings, steal data, or install malicious plugins. The attack requires only a Subscriber-level account and the access_key, which is often publicly available.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in unauthorized data exposure, non-compliance with security controls, and potential legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update WP Fusion to version 3.47.14 or later. Disable the ThriveCart Auto Login feature if not needed. Audit user roles and remove any unauthorized administrator accounts. Monitor for suspicious activity related to user role changes.

Useful 0 Not Useful 0