CVE-2022-33969
📋 TL;DR
This vulnerability allows authenticated WordPress users to modify WordPress options through the Flipbox plugin. Attackers with contributor-level access or higher can change critical site settings, potentially compromising the entire WordPress installation. All WordPress sites using Flipbox plugin version 2.6.0 or earlier are affected.
💻 Affected Systems
- WordPress Flipbox plugin by Biplob Adhikari
📦 What is this software?
Flipbox by Oxilab
⚠️ Risk & Real-World Impact
Worst Case
An attacker could modify WordPress configuration to gain administrative privileges, install backdoors, redirect traffic, or completely compromise the WordPress site and underlying server.
Likely Case
Authenticated attackers would modify site settings to gain elevated privileges, deface the site, or inject malicious code into pages.
If Mitigated
With proper user role management and least privilege principles, only trusted administrators could exploit this, limiting damage potential.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward via crafted AJAX requests. Public exploit details are available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.1
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2648808
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Flipbox' plugin. 4. Click 'Update Now' if available, or download version 2.6.1+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the Flipbox plugin until patched
wp plugin deactivate image-hover-effects-ultimate-visual-composer
Restrict user roles
allLimit contributor and author role assignments to trusted users only
🧯 If You Can't Patch
- Remove the Flipbox plugin completely if not essential
- Implement web application firewall rules to block requests to the vulnerable AJAX endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Flipbox version. If version is 2.6.0 or lower, you are vulnerable.Check Version:
wp plugin get image-hover-effects-ultimate-visual-composer --field=versionVerify Fix Applied:
Verify plugin version is 2.6.1 or higher in WordPress admin panel. Test authenticated user access to plugin settings to ensure proper authorization checks.📡 Detection & Monitoring
Log Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with action parameter related to flipbox
- Multiple option update attempts from non-admin users
- WordPress option changes from unexpected user roles
Network Indicators:
- POST requests to admin-ajax.php with flipbox-related parameters from non-admin IPs
- Unusual wp_options table modification patterns
SIEM Query:
source="wordpress.log" AND ("admin-ajax.php" AND "flipbox") AND NOT user_role="administrator"🔗 References
- https://patchstack.com/database/vulnerability/image-hover-effects-ultimate-visual-composer/wordpress-flipbox-plugin-2-6-0-authenticated-wordpress-options-change-vulnerability
- https://plugins.trac.wordpress.org/changeset/2648808
- https://patchstack.com/database/vulnerability/image-hover-effects-ultimate-visual-composer/wordpress-flipbox-plugin-2-6-0-authenticated-wordpress-options-change-vulnerability
- https://plugins.trac.wordpress.org/changeset/2648808
