Executive brief
A popular security and firewall plugin for WordPress is vulnerable to a flaw that allows attackers to inject malicious scripts into the website's administrative logs. If an administrator views these logs, the attacker's script can execute in their browser, potentially leading to full site takeover or unauthorized administrative actions. This occurs even if the attacker is not logged into the website.
Technical details
The All-In-One Security (AIOS) plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method. When the 'Disable REST API for non-logged in users' and debug logging features are both enabled, the plugin decodes the REQUEST_URI using urldecode() and stores it in the debug log without sanitization. An unauthenticated attacker can send a crafted REST request containing a malicious payload in the path. When an administrator views the Debug Logs page, the unsanitized script is executed in their session context, potentially allowing for session hijacking, nonce theft, or full site compromise. The issue is fixed in versions following 5.4.7.
Affected products
- UpdraftPlus All-In-One Security (AIOS) – Security and Firewall up to and including 5.4.7
Timeline
- 2026-06-06: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/admin/wp-security-list-debug.php
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-debug-logger.php
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-general-init-tasks.php
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/tags/5.4.6/classes/wp-security-utility.php
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/admin/wp-security-list-debug.php
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-debug-logger.php
- https://plugins.trac.wordpress.org/browser/all-in-one-wp-security-and-firewall/trunk/classes/wp-security-general-init-tasks.php