CVE-2020-13764
📋 TL;DR
This vulnerability in the Gravity Forms WordPress plugin allows attackers to retrieve hashed user passwords through improper access control. It affects WordPress sites using Gravity Forms versions before 2.4.9. The issue occurs because user_pass fields aren't properly restricted in certain API calls.
💻 Affected Systems
- Gravity Forms WordPress Plugin
📦 What is this software?
Gravityforms by Rocketgenius
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain password hashes for all users, potentially enabling offline cracking and account takeover across the WordPress site.
Likely Case
Unauthorized access to password hashes for Gravity Forms users, potentially leading to targeted account compromise if weak passwords are used.
If Mitigated
Limited exposure if strong password hashing is used and monitoring detects unusual access patterns.
🎯 Exploit Status
Exploitation requires some level of access to Gravity Forms functionality, but detailed technical information is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.9 and later
Vendor Advisory: https://docs.gravityforms.com/gravityforms-change-log/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Gravity Forms
4. Click 'Update Now' if available
5. Alternatively, download version 2.4.9+ from Gravity Forms website
6. Upload and replace via WordPress plugin uploader
🔧 Temporary Workarounds
Disable Gravity Forms
allTemporarily disable the Gravity Forms plugin until patching is possible
wp plugin deactivate gravityforms
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual API calls to Gravity Forms endpoints
- Enable strong password policies and consider forcing password resets for all users
🔍 How to Verify
Check if Vulnerable:
Check Gravity Forms version in WordPress admin under Plugins → Installed PluginsCheck Version:
wp plugin get gravityforms --field=versionVerify Fix Applied:
Confirm version is 2.4.9 or higher in plugin details📡 Detection & Monitoring
Log Indicators:
- Unusual GET/POST requests to Gravity Forms API endpoints, particularly accessing user properties
Network Indicators:
- Suspicious API calls to /wp-json/gf/v2/ or similar Gravity Forms endpoints
SIEM Query:
source="wordpress" AND (uri_path="*gf*" OR uri_path="*gravity*" OR user_agent="*gravityforms*") AND status=200