On May 2, 2023, Patchstack’s researcher, Rafie Muhammad, discovered a high-severity reflected XSS vulnerability with an assigned identifier CVE-2023-30777. It came to light that Advanced Custom Fields and its paid version, Advanced Custom Fields Pro WordPress plugins, were vulnerable to cross-site scripting attacks, meaning that over 2 million WordPress Websites were under threat.
What Does The Advanced Custom Fields Plugin Do?
The Advanced Custom Fields plugins allow site administrators to easily add fields to their WordPress pages or other site elements. Hence, it’s not surprising that such a huge chunk of WordPress users has a version of this plugin installed on their website.
Considering that these two plugins are WordPress’s most popular custom field builders, the news caused some serious stir in the community and has once again directed attention toward the importance of security, routine updates, and digital safety.
What are XSS bugs?
Cross-site scripting (XSS) bugs typically work by allowing the attacker to inject malicious scripts on websites, which leads to the malicious code being executed on the website visitor’s web browser. According to the Patchstack bulletin, the XSS could only be triggered from logged-in users that already had access to the Advanced Custom Fields plugin. This means the attacker still needs to social engineer a visitor with access to the plugin to trigger the flaw.
If successful, this could result in any number of cyber crimes, including but not limited to stealing sensitive information, taking over the impacted WordPress website, redirects, or other HTML payloads.
While most people visit or manage websites daily, most overlook the importance of being diligent with digital security. This includes updating plugins, as highlighted by the XSS vulnerability discussed in the article, and much more.
It’s crucial that all website developers implement cybersecurity tools into their websites and daily life. The simplest way is to get a VPN covering your cyber-security basics – concealing your IP address, setting up barriers to prevent unauthorized attackers from getting to your personal data, and creating a secure network for devices for a safe file sharing process.
Luckily the aforementioned Patchstack researcher caught the flow in a function configured as an extra handler (the “admin_body_class” function handler) for a WordPress hook that controls the design and layout for the main body tag in the admin area of WordPress sites. According to Patchstack, the flaw resulted from the function handler failing to sanitize the output value of a hook properly.
To all the WordPress user’s relief, the flaw has now been fixed in the 6.16 version of the plugin, which now has a new function name, ‘esc-attr.’ In the updated version, the function properly sanitizes the output value of the admin_body_class hook, meaning that the websites that use this plugin don’t have to worry about being vulnerable to XSS if they have the latest version of the plugin.
Gaps In Our Thinking about Cyber-Security
All the Advanced Custom Fields’ and ‘Advanced Custom Fields Pro users were advised to upgrade to the new version immediately. However, based on WordPress.org stats, more than 70% of the plugin users are still using the previous version, highlighting the importance of the persistent need to spread knowledge about the best security practices online.
If anything, the incident with WordPress has shown us that there is still a long way to go for most of us when it comes to cyber security and doing our part in protecting our digital spaces and websites.
