Malcure Malware Shield WordPress Plugin Auth Bypass RCE

Executive Summary

This vulnerability affects the Malcure Malware Shield WordPress plugin versions before 19.9.7. It allows users with a subsite administrator role in a multisite network to exploit a missing authorization check in an AJAX action. This enables them to write and delete arbitrary files in the network's shared filesystem, which could lead to remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Malcure Malware Shield plugin in your WordPress admin panel. If it is below 19.9.7, the vulnerability is present. Review server logs for unauthorized file write or delete operations, particularly from users with subsite administrator roles.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a subsite administrator role could exploit this to gain full control over the WordPress multisite network by executing arbitrary code. This could result in data breaches, malware distribution, or complete site compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage due to non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Malcure Malware Shield plugin to version 19.9.7 or later immediately. Remove unnecessary subsite administrator accounts and restrict file write permissions on the server to limit potential exploitation.

Useful 0 Not Useful 0