Introduction
Attackers have taken over WordPress sites running the Platform theme by exploiting a critical flaw that needs no authentication and no user interaction. The result is privilege escalation, full site compromise, and persistent unauthorized access.
About the Platform Theme and Pagelines
Pagelines was a well-known WordPress theme developer in the early 2010s, and the Platform theme was one of its flagship products. At its peak, the Platform theme ran on tens of thousands of WordPress sites, especially among small businesses and agencies that wanted drag-and-drop functionality. DraftPress later acquired the company, and the Platform theme has since been discontinued, but legacy installations are still in use.
Technical Information
CVE-2015-10143 is a critical privilege escalation vulnerability in the Platform theme for WordPress. The flaw is in the *_ajax_save_options() function, which is reachable through the standard WordPress admin-ajax.php endpoint. The function was meant to let administrators update theme options over AJAX. It skips the capability check (something like current_user_can('manage_options')), so any user, including an unauthenticated visitor, can call it.
By sending a POST request to /wp-admin/admin-ajax.php with the action parameter set to pagelines_ajax_save_options, an attacker can supply arbitrary options to update. Setting users_can_register to 1 and default_role to administrator, for example, turns on public registration and assigns new users the administrator role. The attacker then registers an account and gains full administrative privileges on the site.
The vulnerability affects all versions of the Platform theme before 1.4.5. The root cause is the missing permission check in the AJAX handler, which allows unauthenticated changes to sensitive WordPress options.
Patch Information
The Wazuh team shipped a ruleset update that expands detection across more security events. It adds rules and decoders for several services and platforms, widening the range of monitored activity.
Key additions:
- Carbanak detection rules for the Carbanak banking Trojan
- Cisco Firepower Threat Defense (FTD) rules and decoders for network security monitoring
- Decoders for Amazon Elastic Kubernetes Service (EKS) to monitor containerized applications
- F5 BIG-IP rules to detect threats to application delivery controllers
- Google Cloud Platform rules for Virtual Private Cloud (VPC) storage, firewall, and flow logs
- GitLab v12 rules to monitor DevOps pipelines
- Microsoft Exchange Server rules and decoders for email server events
- Microsoft Windows persistence detection via registry keys
- Oracle Database 12c rules and decoders
- Cloudflare Web Application Firewall (WAF) rules
- ESET Remote Administrator Console rules for endpoint security management
- GitHub audit log rules for code repository security
- Palo Alto Networks rules for versions 8.X to 10.X
- Sophos Unified Threat Management (UTM) firewall rules
- Wazuh API rules to monitor the management interface
Security Configuration Assessment (SCA) policies:
The update also adds SCA policies for several operating systems and applications:
- Amazon Linux 1 and 2
- Apple macOS 10.14 Mojave, 10.15 Catalina, and Big Sur
- Microsoft IIS 10 and SQL 2016
- MongoDB 3.6
- NGINX
- Oracle Database 19c
- PostgreSQL 13
- SUSE Linux Enterprise Server 15
- Ubuntu 14, 16, 18, and 20
- Solaris 11.4
These policies supply checks for configuring systems securely against common benchmarks. Together, the additions let Wazuh detect and respond to a wider range of security events across more environments.
Reference: Wazuh Changelog 4.3.0
Affected Systems and Versions
- Platform theme for WordPress, all versions before 1.4.5
- Sites with the Platform theme installed and active
- The vulnerability is present regardless of other WordPress configuration settings
Vendor Security History
Pagelines has had several security issues in its products over the years. Examples include a remote code execution vulnerability in Platform Pro (CVE-2014-100001) and a cross-site scripting vulnerability in the BaseTheme product line. Pagelines usually responded with patches, but discontinued products like Platform leave some sites exposed when they are not updated or migrated.
