{"uuid": "4ee46c21-b2ff-4fea-879f-dcfa0f1927f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-1654", "type": "seen", "source": "https://t.me/hacking_Attack/54164", "content": "Black Hat Ethical Hacking\nCritical Vulnerability in Premium WordPress Themes Allows for Site Takeover\n\nCritical Vulnerability in Premium WordPress Themes Allows for Site TakeoverPost Views: 1 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nA critical privilege escalation flaw found in two themes used by more than 90,000 WordPress sites can allow threat actors to take over the sites completely, researchers have found.\nWordFence Threat Intelligence Team researcher Ramuel Gall discovered the flaw, one of five vulnerabilities he found between early April and early May in the Jupiter\u00a0and JupiterX Premium WordPress themes, he revealed in a blog post\u00a0published Wednesday.\n\nOne of the flaws\u2014tracked as CVE-2022-1654\u00a0and rated as 9.9, or critical on the CVSS\u2013allows for \u201cany authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges and completely take over any site running either the Jupiter Theme or JupiterX Core Plugin,\u201d he wrote. The plugin is required to run the JupiterX theme.\n\nAffected versions of the themes are: Jupiter Theme 6.10.1 or earlier, and JupiterX Core Plugin 2.0.7 or earlier.\n\nWordFence finished their investigation of most of flaws on April 5 and reported them to the Jupiter and JupiterX theme developer ArtBees\u00a0on the same day; on May 3 they notified the developer of an additional Jupiter theme flaw. By May 10, the developed had released updated versions of both the Jupiter and JupiterX themes that had patched all the flaws.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Critical VulnerabilityThe critical flaw found resides in a function, uninstallTemplate, which is intended to reset a site after a template is uninstalled. However, it \u201chas the additional effect of elevating the user calling the function to an administrator role,\u201d Gall wrote. In the Jupiter theme, the function is found in the theme itself; in JupiterX, it\u2019s present in the JupiterX Core plugin.\n\n\u201cVulnerable versions register AJAX actions but do not perform any capability checks or nonce checks,\u201d he wrote.\n\nOn a site with a vulnerable version of the Jupiter Theme installed, any logged-in user can elevate their privileges to those of an administrator by sending an AJAX request with the action parameter set to abb_uninstall_template. This calls the uninstallTemplate function, which calls the resetWordpressDatabase function, which effectively reinstalls the site with the currently logged-in user as the new site owner, Gall explained.\n\nOn a site where a vulnerable version of the JupiterX Core plugin is installed, someone can access the same functionality by sending an AJAX request with the action parameter set to jupiterx_core_cp_uninstall_template, he said.\nSee Also: Attackers Use Event Logs to Hide Fileless Malware See Also: Offensive Security Tool: malicious-pdf Other VulnerabilitiesWordPress plugins, often developed by third-party developers, are notoriously buggy. Previous flaws found in plugins for the popular website-creation and -hosting platform also have allowed for site takeover, as well as enabled WordPress subscribers to totally wipe\u00a0sites not belonging to them, or attackers to forge emails\u00a0to subscribers.\n\nOf the other flaws that Gall discovered, three\u2014tracked as CVE-2022-1656, CVE-2022-1658\u00a0and CVE-2022-1659\u2013are rated as medium risk and one, CVE-2022-1657\u00a0is rated as high risk.\n\nThe high-risk flaw, which affects JupiterX Theme 2.0.6 or earlier and Jupiter Theme 6.10.1 or earlier, can allow an attacker to obtain[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:38.158732Z"}