CVE-2019-25216
📋 TL;DR
The Rich Review WordPress plugin versions up to 1.7.4 contain a stored cross-site scripting vulnerability in the 'update' POST parameter. Unauthenticated attackers can inject malicious scripts that execute when users view compromised pages. This affects all WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- Rich Reviews WordPress Plugin
📦 What is this software?
Rich Review by Starfish
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers inject malicious scripts to steal user session cookies, redirect visitors to phishing sites, or display unwanted advertisements.
If Mitigated
With proper input validation and output escaping, the vulnerability would be prevented, though the plugin would still need updating.
🎯 Exploit Status
Exploits have been observed in the wild according to Wordfence reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.5 or later
Vendor Advisory: https://wordpress.org/plugins/rich-reviews/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Rich Reviews plugin. 4. Click 'Update Now' if available. 5. If no update available, deactivate and delete the plugin.
🔧 Temporary Workarounds
Disable Rich Reviews Plugin
allDeactivate the vulnerable plugin to prevent exploitation.
wp plugin deactivate rich-reviews
Apply Web Application Firewall
allConfigure WAF to block XSS payloads targeting the 'update' parameter.
🧯 If You Can't Patch
- Deactivate and remove the Rich Reviews plugin immediately
- Implement strict Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Rich Reviews for version number. If version is 1.7.4 or lower, you are vulnerable.Check Version:
wp plugin get rich-reviews --field=versionVerify Fix Applied:
After updating, verify plugin version is 1.7.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with 'update' parameter containing script tags or JavaScript code
- Unusual plugin file modifications
Network Indicators:
- HTTP requests with suspicious payloads in POST body targeting the plugin's AJAX endpoint
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND method="POST" AND (body CONTAINS "<script>" OR body CONTAINS "javascript:")🔗 References
- https://wordpress.org/support/topic/plugin-not-supported-open-to-malware-uninstall-now/
- https://wpscan.com/vulnerability/81bdc004-9b9c-49e2-b337-35a6d8395c5d
- https://www.wordfence.com/blog/2019/09/rich-reviews-plugin-vulnerability-exploited-in-the-wild/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/db701ad3-10fd-4a40-b239-139fbc95ab61?source=cve
