Themes for WordPress PageLines and Platform contain dangerous vulnerabilities: this flaws allows remote code execution and elevate privileges, thereby acquiring full control over the site.
Released this week PageLines 1.4.6 version and Platform 1.4.4 version contains fixes for serious vulnerabilities, so users working with these themes for WordPress, as soon as possible to install the updates.
Exploiting a flaw in older versions of Platform, attackers can remotely execute code and thereby gain complete control over the web-site. In addition, the vulnerability in PageLines and Platform allows the user with an account on the site to gain escalated privileges and become an administrator.
It is worth noting that both themes are very popular – each of which has been downloaded a million times. Given the fact that in order to make a profit malefactors create botnets, site with vulnerable theme can be a part of.
In order to update the Platform and PageLines theme, you need to login, where uses theme, go to the Control Panel and select “Updates”. If you are using older versions of the Platform and PageLines themes, the update page will display information about this, and will be provided with management tools that will help establish the new version.
More information about the vulnerabilities you can be found below.
Multiple vulnerabilities in Pagelines and Platform for WordPress
Danger level: High
The presence of fixes: Yes
The number of vulnerabilities: 2
CVSSv2 rating: (AV: N / AC: L / Au: N / C: C / I: C / A: C / E: U / RL: OF / RC: C) = Base: 10 / Temporal: 7.4
(AV: N / AC: L / Au: N / C: C / I: C / A: C / E: U / RL: OF / RC: C) = Base: 10 / Temporal: 7.4
Vector of operating: Remote
Impact: Privilege escalation, system compromise
Affected products: WordPress Pagelines 1.4.x, WordPress Platform 1.4.x
Affected versions: WordPress Pagelines versions up to 1.4.6, WordPress Platform versions up to 1.4.4
The vulnerability allows a remote user to compromise a vulnerable system.
1. [Privilege escalation on Pagelines and Platform] The vulnerability is due to the fact that wp_ajax_ can be used by any authorized user (all wp_ajax_ hooks are usable by any logged-in users). This can be exploited to gain escalated privileges on the web-site of the victim.
Note: Successful exploitation requires that the attacker’s portal allows you to register the user.
2. [Remote Code Execution on Platform] The vulnerability is due to the fact that the theme used a somewhat unconventionnal way to import theme settings backups. A remote user can execute arbitrary code on the target system.
Note: The vulnerability affects only WordPress Platform.
Solution: Install the latest version from the manufacturer.
Manufacturer URL: https://wordpress.org/