CVE-2024-6489
📋 TL;DR
The Getwid WordPress plugin has a missing capability check vulnerability that allows authenticated users with Contributor-level access or higher to modify the MailChimp API key. This affects all versions up to and including 2.0.10. Attackers could potentially disrupt email marketing functionality or redirect communications.
💻 Affected Systems
- Getwid - Gutenberg Blocks WordPress plugin
📦 What is this software?
Getwid by Motopress
⚠️ Risk & Real-World Impact
Worst Case
An attacker could replace the legitimate MailChimp API key with their own, allowing them to access email lists, send unauthorized emails, or disrupt email marketing campaigns.
Likely Case
Disruption of email marketing functionality by changing the API key to an invalid value, causing email communications to fail.
If Mitigated
Minimal impact if proper access controls and monitoring are in place to detect unauthorized configuration changes.
🎯 Exploit Status
Exploitation requires authenticated access with at least Contributor privileges. The vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.11
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3119180/getwid/trunk/includes/blocks/google-map.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Getwid - Gutenberg Blocks. 4. Click 'Update Now' if available, or download version 2.0.11+ from WordPress.org. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Remove Contributor Role Access
allTemporarily restrict Contributor-level users from accessing the site until patching is complete.
Disable Getwid Plugin
linuxTemporarily deactivate the Getwid plugin if not essential for site functionality.
wp plugin deactivate getwid
🧯 If You Can't Patch
- Restrict user roles to only trusted administrators who need access to plugin settings.
- Implement additional monitoring for configuration changes to the Getwid plugin settings.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → Getwid - Gutenberg Blocks version. If version is 2.0.10 or lower, the site is vulnerable.Check Version:
wp plugin get getwid --field=versionVerify Fix Applied:
After updating, verify the plugin version shows 2.0.11 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual API key changes in Getwid plugin logs
- Multiple failed attempts to modify plugin settings from non-admin users
Network Indicators:
- Unusual outbound connections to MailChimp API from unexpected user accounts
SIEM Query:
source="wordpress" AND (event="plugin_settings_change" OR event="api_key_modification") AND plugin="getwid"🔗 References
- https://plugins.trac.wordpress.org/changeset/3119180/getwid/trunk/includes/blocks/google-map.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe391ac9-e3ea-48b3-8ffe-243972ce89f6?source=cve
- https://plugins.trac.wordpress.org/changeset/3119180/getwid/trunk/includes/blocks/google-map.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fe391ac9-e3ea-48b3-8ffe-243972ce89f6?source=cve
