Executive Summary

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to 2.0.0. This vulnerability allows an authenticated attacker with Contributor-level access and above to escalate their privileges to Administrator. The exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active.

Technical Analysis

The vulnerability exists in the `save_meta_boxes()` function, which persists the `_wps_plan_user_role` membership plan meta from `$_POST` without proper validation. The only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value. Additionally, the UI's `disabled` attribute on the role dropdown is a client-side-only control that can be trivially bypassed via DevTools or a direct POST request.

How It Gets Exploited

An authenticated attacker with Contributor-level access and above can exploit this vulnerability by storing `'administrator'` as the role granted on membership acquisition. This can be done by sending a crafted POST request to the `save_meta_boxes()` function, bypassing the client-side controls. Once the role is stored, the Pro companion plugin will apply the role via `add_role()` during membership lifecycle events, effectively escalating the attacker's privileges to Administrator.

Impact Assessment

The Subscriptions for WooCommerce plugin versions up to 2.0.0 are affected. An attacker can achieve privilege escalation to Administrator, which can lead to complete control over the WordPress site. The CVSS score for this vulnerability is 8.8, indicating a High severity level.

Recommended Actions

Update the Subscriptions for WooCommerce plugin to version 2.0.1 or later. Ensure that the Subscriptions for WooCommerce Pro companion plugin is updated to the latest version. Monitor for suspicious activity, especially privilege escalation attempts. Implement additional security measures, such as limiting the privileges of Contributors and above, and monitoring for unusual POST requests to the `save_meta_boxes()` function.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence