CVE-2015-10143
📋 TL;DR
The Platform theme for WordPress has an authentication bypass vulnerability that allows unauthenticated attackers to modify WordPress site options. This can be exploited to change user registration settings and create administrator accounts, giving attackers full control of vulnerable WordPress sites. All WordPress sites using Platform theme versions before 1.4.4 are affected.
💻 Affected Systems
- WordPress Platform theme
📦 What is this software?
Platform Theme by Pagelines
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover - attackers gain administrative access, can deface the site, steal data, install malware, or use the site for further attacks.
Likely Case
Site compromise leading to data theft, malware distribution, or use as part of a botnet.
If Mitigated
Attackers can still modify site options but cannot escalate privileges if user registration is disabled and strong access controls are in place.
🎯 Exploit Status
Metasploit module available. Exploitation requires sending crafted AJAX requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.4
Vendor Advisory: https://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelinesplatform-theme-for-wordpress.html
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Update Platform theme to version 1.4.4 or later. 4. If update not available, replace with patched version manually.
🔧 Temporary Workarounds
Disable Platform theme
allSwitch to a different WordPress theme that is not vulnerable
wp theme activate twentytwentyfour
wp theme delete platform
Block vulnerable endpoint
linuxAdd web application firewall rule to block requests to the vulnerable AJAX endpoint
# Add to .htaccess for Apache:
RewriteRule ^wp-content/themes/platform/framework/ajax/.*$ - [F,L]
# Add to nginx config:
location ~* ^/wp-content/themes/platform/framework/ajax/ { deny all; }
🧯 If You Can't Patch
- Disable user registration in WordPress settings (Settings > General > Membership)
- Implement web application firewall with rules to detect and block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress theme directory for Platform theme version. If version is less than 1.4.4, the site is vulnerable.Check Version:
wp theme list --field=name,version | grep platformVerify Fix Applied:
Confirm Platform theme version is 1.4.4 or later in WordPress admin panel under Appearance > Themes.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-content/themes/platform/framework/ajax/options.php
- Unusual option changes in WordPress database
- New administrator user creation
Network Indicators:
- HTTP POST requests containing 'action=platform_ajax_save_options'
- Requests to admin-ajax.php with platform-specific parameters
SIEM Query:
source="web_logs" AND (uri_path="/wp-content/themes/platform/framework/ajax/options.php" OR post_data CONTAINS "platform_ajax_save_options")🔗 References
- https://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelinesplatform-theme-for-wordpress.html
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_platform_exec.rb
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c16fab08-6b2c-433a-9105-fc15f5c52575?source=cve
