"Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks"

Security researchers at Patchstack have discovered a vulnerability in several extensions for the All-in-One WP Migration plugin, potentially exposing WordPress websites to attacks leading to sensitive information disclosure.  With more than five million installations and maintained by ServMask, All-in-One WP Migration is a highly popular plugin for moving websites that also provides several premium extensions for migrating to third-party platforms.  The vulnerability impacts All-in-One WP Migration's Box, Google Drive, OneDrive, and Dropbox extensions that could allow attackers to access sensitive information.  The vulnerability is tracked as CVE-2023-40004 and is described as an unauthenticated access token manipulation issue.  The researchers noted that the bug could allow an unauthenticated attacker to tamper with the access token configuration of the affected extension.  The researchers stated that this "access token manipulation could result in a potential sensitive information disclosure of migration to the attacker's controlled third-party account or restore a malicious backup."  The researchers noted that the flaw was identified in the init function of the affected extensions, which is "hooked to the WordPress's admin_init hook," which in turn can be triggered by an attacker without authentication.  The researchers stated that since there is no permission and nonce validation on the init function, an unauthenticated user is able to modify or delete the access token used on each of the affected extensions.  On July 18, the researchers reported the vulnerability to ServMask, which patched the bug in all impacted extensions by "adding permission and nonce validation on the init function." Users are advised to update to All-in-One WP Migration's Box extension version 1.54, Google Drive extension version 2.80, OneDrive extension version 1.67, and Dropbox extension version 3.76, which were released at the end of July.

SecurityWeek reports: "Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks"