ThemeGrill Demo Importer opens wordpress sites to hackers

A popular WordPress theme plugin with over 200,000 active installations contains a severe but easy-to-exploit software vulnerability that, if left unpatched, could let unauthenticated remote attackers compromise a wide range of websites and blogs.

Dubbed ‘ThemeGrill Demo Importer‘, the vulnerable plugin comes with free as well as premium themes sold by the software development company ThemeGrill.

According to a report WebARX security company shared, when a ThemeGrill theme is installed and activated, the affected plugin executes some functions with administrative privileges without checking whether the user running the code is authenticated and is an admin.

“This is a serious vulnerability and can cause a significant amount of damage. Since it requires no suspicious-looking payload just like our previous finding in InfiniteWP, it is not expected for any firewall to block this by default and a special rule needs to be created to block this vulnerability,” reads the report in part.

ThemeGrill Demo Importer plugin has been designed to allow WordPress site admins to import demo content, widgets, and settings from ThemeGrill, making it easier for them to quickly customize the theme.

The flaw could eventually allow unauthenticated remote attackers to wipe the entire database of targeted websites to its default state, after which they will also be automatically logged in as an administrator, allowing them to take complete control over the sites.

In the above screenshot, there is no authentication check, and only the do_reset_wordpress parameter needs to be present in the URL on any ‘admin’ based page of WordPress, including /wp-admin/admin-ajax.php.

The WebARX research further notes that the vulnerability affects ThemeGrill Demo Importer plugin version 1.3.4 up to 1.6.1, all released in the last 3 years.

“This is a serious vulnerability and can cause a significant amount of damage as it requires no suspicious-looking payload. It is not expected for any firewall to block this by default, and a special rule needs to be created to block this vulnerability,” the WebARX report.

WebARX provides vulnerability detection and virtual patching software to protect websites from the third-party component vulnerabilities, responsibly reported this vulnerability to ThemeGrill developers two weeks ago, who then released a patched version 1.6.2 on February 16.

WordPress Dashboard automatically notifies admins when a plugin needs to be updated, but they can choose to have plugin updates automatically installed instead of waiting for manual action.