Uncharted Depths: Navigating Overlooked Vulnerabilities in the Sea of Million WordPress Sites

No ratings

Presented at Off-by-One Conference 2024 by

Rafie Muhammad

Content Management System (CMS) platform is still one of the best options to build a website quickly. CMS provides a user-friendly interface that allows non-technical users to easily create, edit, and publish content without requiring extensive HTML, CSS, or Javascript programming language knowledge. WordPress is still the most popular CMS platform, powering 43.2% of the websites online, with a CMS market share of 63.5%. With its popularity, it’s prone to massive exploit attempts. The WordPress Core itself is not the actual target, the plugins and themes are the actual target of an attacker with the vast majority of the security bugs being found in plugins and themes. This talk will cover deep technical details of overlooked impactful vulnerabilities discovered in WordPress Core and across the most popular WordPress plugins, with each component having more than a hundred thousand active installations. We will also cover vulnerability in one of the most popular libraries used in plugins and themes, which could affect more than 7 million websites. We will use multiple cases of overlooked XSS and privilege escalation attack vectors which could be easily exploited in the wild. We will show how we found these vulnerability cases and how to secure the code from these potential vulnerabilities. Join us for the journey of exploiting the WordPress ecosystem (An Exploit demo is included too !)