As elaborated in their recent blog post, the team first discovered the vulnerabilities in the Post Grid plugin. While investigating a flaw in it, they discovered similar bugs in the Team Showcase plugin.
It means that the vulnerabilities in both the plugins potentially risked thousands of websites to cyber attacks.
Regarding the bugs, briefly, the researchers found two different vulnerabilities affecting both plugins.
One of these includes a stored cross-site scripting (XSS) flaw. To exploit the flaw, an attacker simply had to trigger the vulnerable functions by sending an AJAX request. This would then make it possible for the attacker to execute malicious codes. Also, the attacker could take over the site, steal admin’s session data, and include backdoors.
As described in the post,
Regardless of how the vulnerable function was triggered, an attacker could supply aThe other vulnerability was a PHP object injection flaw that could also allow arbitrary code execution and site takeover.sourceparameter pointing to a crafted malicious payload hosted elsewhere. The function would then open the file containing the payload, decode it, and create a new page layout based on its contents. The created layout included acustom_scriptssection, and an attacker could add malicious JavaScript to thecustom_cssportion of this section. This would then be executed whenever an administrative user edited the layout or a visitor visited a page based on the layout.
Both the vulnerabilities achieved a high-severity rating with a CVSS score of 7.5.
Soon after their report, the developers patched the bugs with the release of Post Grid v2.0.73 and Team Showcase v1.22.16.
Post Grid plugin presently has over 60,000 active installations. It facilitates displaying posts on a site in a grid layout. Whereas, Team Showcase plugin boasts over 6000 installations. This plugin displays the team members of an organization on the website
