- Researchers from Patchstack find two new bugs in Fancy Product Designer
- The Radykal-built WordPress plugin has more than 20,000 active users
- The flaws allowed remote code execution, arbitrary file uploads and more
A popular WordPress plugin was found with two critical vulnerabilities that allow threat actors to upload files, manipulate databases and essentially take over compromised websites.
To make matters worse, the vulnerabilities remained in the code for more than half a year, despite the developers being notified and actively working on new versions in the meantime.
Cybersecurity researchers from Patchstack claim at the end of March 2024 that they discovered two vulnerabilities in Fancy Product Designer, a premium website builder plugin developed by Radykal that allows users to create and customize products, such as t-shirts, mugs or posters , with various design tools and options for e-commerce stores. It has more than 20,000 sales.
The silence of the sellers
The vulnerabilities are tracked as CVE-2024-51919 (severity 9.0) and CVE-2024-51818. The former is an unauthorized arbitrary file upload vulnerability, while the latter is an unauthorized SQL injection flaw. Since the former allows remote code execution (RCE), it can lead to full site takeover in some scenarios.
Patchstack claims to have notified the vendor of the issues in late March, but never heard back from the company. Meanwhile, Radykal worked on new versions of the plugin and released 20 of them. The latest one was pushed two months ago (6.4.3) and it still carries the critical security flaws.
To warn users of the risks and to draw attention to the problem, Patchstack added the bugs to its database and published an in-depth blog with the technical information contained within enough to build an exploit and target websites using Fancy Product Designer.
To prevent that from happening, web administrators should create a whitelist of allowed file extensions, thus preventing threat actors from uploading whatever they want. Patchstack added that users should also sanitize user input to a query to defend against SQL injection attacks.
Via Bleeping Computer
