On October 5, 2022, the Wordfence Threat Intelligence team responsibly disclosed a Missing Authorization vulnerability in Blog2Social, a WordPress plugin installed on over 70,000 sites that allows users to set up post sharing to various social networks.
Vulnerable versions of the plugin make it possible for authenticated attackers with minimal permissions, such as subscribers, to change the plugin’s settings.
Wordfence initially reached out to the developer via email on October 1, 2022. After receiving a response from the developer shortly thereafter, Wordfence disclosed this vulnerability to their team on October 5, 2022. A partial fix was provided within a day (version 6.9.11) with a full fix following on October 10, 2022 (version 6.9.12).
At the time of discovery, Wordfence did not release a firewall rule as they determined that the vulnerability is unlikely to be targeted and has a relatively low impact. After further evaluation, they decided to release a firewall rule on October 27, 2022 as a precautionary measure. Premium, Care, and Response customers received that protection the same day, while sites still running the free version of Wordfence will receive the same protection 30 days later on November 26, 2022. As such, Wordfence strongly recommend updating to version 6.9.12 or higher of Blog2Social to ensure that your site is protected against any exploits targeting this vulnerability.
Description: Missing Authorization to Authenticated (Subscriber+) Settings Update
Affected Plugin: Blog2Social
Plugin Slug: blog2social
Affected Versions: <= 6.9.11
CVE ID: CVE-2022-3622
CVSS Score: 4.7 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Researcher/s: Marco Wotschka
Fully Patched Version: 6.9.12
Timeline
October 1, 2022 – Initial outreach to the plugin developer.
October 5, 2022 – We disclosed details of the vulnerabilities with the developer.
October 6, 2022 – Version 6.9.11 is released which provides a patch for the legacy mode update vulnerability.
October 10, 2022 – The remaining authorization vulnerabilities are patched in version 6.9.12.
October 27, 2022 – Wordfence Premium, Care, and Response customers receive a firewall rule to provide additional protection.
November 26, 2022 – Wordfence Free users receive a firewall rule.
Conclusion
In today’s post, we covered several vulnerabilities in the Blog2Social: Social Media Auto Post & Scheduler plugin that could be used by subscribers to update plugin settings due to improper authorization checks. The vulnerabilities were patched by ensuring that capabilities were checked.
Wordfence Premium, Care, and Response users received a firewall rule on October 27th, 2022 for enhanced protection. Wordfence free users will receive this rule after 30 days on November 26th, 2022. We strongly recommend updating to version 6.9.12 or higher of Blog2Social: Social Media Auto Post & Scheduler to ensure that your site is protected against any exploits targeting this vulnerability.