WordPress Anti-Spam Plugin Vulnerability

WordPress vulnerability discovered in popular anti-spam plugin installed in over 60,000 website

[{"selector":"#anim-0b5d958e-941b-4df3-82aa-35a131706be7","keyframes":[{"offset":0,"transform":"translate3d(0, -1467.19511%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.29,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.45,"transform":"translate3d(0, -412.57526493200004%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.61,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.71,"transform":"translate3d(0, -140.26385251600001%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.8,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.85,"transform":"translate3d(0, -52.67230444900001%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.92,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.96,"transform":"translate3d(0, -22.888243716%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":1,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"}],"delay":0,"duration":600,"fill":"both"}] [{"selector":"#anim-c5d44cf9-614d-49db-9121-9a6aef1368cf","keyframes":[{"offset":0,"transform":"translate3d(0, -911.9162%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.29,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.45,"transform":"translate3d(0, -256.43083544%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.61,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.71,"transform":"translate3d(0, -87.17918872%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.8,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.85,"transform":"translate3d(0, -32.73779158%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":0.92,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"},{"offset":0.96,"transform":"translate3d(0, -14.22589272%, 0)","easing":"cubic-bezier(.5, 0, 1, 1)"},{"offset":1,"transform":"translate3d(0, 0%, 0)","easing":"cubic-bezier(0, 0, .5, 1)"}],"delay":0,"duration":600,"fill":"both"}] [{"selector":"#anim-97ce477b-648b-4147-aae6-8154e5e4f53b [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(43.749999771336014%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] Block Spam Users, Comments, Forms WordPress plugin.

[{"selector":"#anim-ec23d1eb-969b-4f72-969e-69c21c918d04","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-08aea02d-904c-4306-a835-1000a64b1fe3","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-033d35de-af51-4157-963a-5aa9d9e7e3a3 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(3.9705882132557697%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] The purpose of the plugin is to stop spam in comments, forms, and sign-up registrations.

[{"selector":"#anim-332456e2-b216-4068-8a05-de08cdac9920","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c38cd630-1edb-4523-96f9-63deddaf98de","keyframes":{"transform":["translate3d(-123.82813%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c3c107ef-751c-4638-8e1c-32722fe00e7c","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-53c62b47-6897-40fd-841c-f13b7cc7b81b","keyframes":{"transform":["translate3d(-116.72475%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-2e30d904-037d-4ae1-b573-7d062b370cc2 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(21.481215473560518%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] WordPress vulnerability discovered in popular anti-spam plugin installed in over 60,000 website

[{"selector":"#anim-6b733cee-14cc-4238-a3c6-026a5f38f768","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c0f94012-e5a9-4b3d-88e9-115b7d98aec9","keyframes":{"transform":["translate3d(0px, -608.39783%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c78dec84-58e6-47e7-8b95-023388535737","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-77d614a1-36f2-4d50-9465-65c8b3422737","keyframes":{"transform":["translate3d(0px, -488.27728%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8054166b-f9bd-4145-9b8f-9721a4b59277 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(-34.00735280205888%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] It is a required practice for any WordPress plugin or form that accepts a user input to only allow specific inputs.

[{"selector":"#anim-fe3f3e52-ee2e-42de-afc0-dbc7169a2ad2","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-74c6ad25-d767-4fa4-b13b-cfeaa9d5a000","keyframes":{"transform":["translate3d(0px, 303.47210%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d672189f-35a3-4694-9571-e1833f8bfc02","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-99c3e22d-22ed-46f1-b232-c2223f51c7c6","keyframes":{"transform":["translate3d(0px, 228.81564%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e441c5c3-6f8d-4851-a9c8-eeed883b4157 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(6.839914009846648%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] That filtering process that keeps out unwanted inputs is called sanitization .

[{"selector":"#anim-b669ee55-6cde-4d3b-afec-e74733dc3d06","keyframes":{"opacity":[1,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-bd94bd07-affe-41fd-a4ee-c2f64b80d73a","keyframes":{"transform":["scale(3)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-b585d9a5-e0d0-4c19-a956-fd0e69bbc9fb","keyframes":{"opacity":[1,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-96a4b4da-8cb1-4329-8049-2a69f93b0e01","keyframes":{"transform":["scale(3)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-dccb358a-aa69-49b6-9397-defce1cf42ca [data-leaf-element=\"true\"]","keyframes":{"transform":["translate(1.747124743004747%, 0%) scale(1.5)","translate(0%, 0%) scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] A contact form should have a function that inspects what is submitted and block anything that is not text.

[{"selector":"#anim-0fea273a-cb3f-4120-aa4b-f15bdde6d923","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-df00999d-7bd2-4d00-afb4-0ef685bd56e2","keyframes":{"transform":["translate3d(135.93751%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9fcf2aad-70af-4bf6-a5e5-10286ccb69f7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-bf885a9a-4eb6-4987-8c5b-3eb04d70c34a","keyframes":{"transform":["translate3d(129.18151%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0e707e86-de23-4fbf-a956-6c58170e5061 [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(34.179687404002955%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] The plugin passes base64 encoded user input to the unserialize PHP function when CAPTCHA are used.

[{"selector":"#anim-d24ecbf9-cda8-4703-b630-3d5abe8b136f","keyframes":{"transform":["translate3d(-137.10937%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-03db558e-17e2-4184-8d26-04d6fedad1f2","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-fcfbe2b6-be1b-41a3-9362-9b8a4f6d50b6","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-9921cb3d-c0a1-4c6a-968c-be75a406fb43","keyframes":{"transform":["translate3d(-128.26856%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-799a06b5-9938-4c29-ad08-6a0ffbc535d5","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] [{"selector":"#anim-4a3c45f9-4685-45ed-b72e-aa942d52462a","keyframes":{"transform":["scale(0.15)","scale(1)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"forwards"}] [{"selector":"#anim-7de8d160-6398-4b76-b7fe-58d64443baef [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(19.101572962640034%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] The non-profit Open Web Application Security Project describes the potential impact of these kinds of vulnerabilities.

[{"selector":"#anim-8d14f3eb-9777-4132-b25a-4ab2fd04b1db","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-7ec8be48-0b0b-4dee-bf2b-cb8a92bb7327","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-71c314c5-acb7-4e2a-981f-9207bfeab737","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] [{"selector":"#anim-1f5b5ef4-db59-4d60-9848-c89c761cff66","keyframes":{"transform":["scale(0.3333333333333333)","scale(1)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"forwards"}] [{"selector":"#anim-1ce250b9-b943-40d1-b6dd-9b9debd8588c [data-leaf-element=\"true\"]","keyframes":{"transform":["translate3d(31.225066375436132%, 0, 0)","translate3d(0%, 0, 0)"]},"delay":0,"duration":2000,"easing":"cubic-bezier(.3,0,.55,1)","fill":"both"}] The vulnerability in the Stop Spammers Security WordPress plugin was fixed in version 2022.6