Description

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-12T06:16:27.250Z",
  "pubdate": "2026-09-12T06:16:27.250Z",
  "executiveSummary": "The WP Component WordPress plugin through version 2.2.4 contains a critical security vulnerability involving the lack of authorization and nonce validation in a publicly accessible action. This vulnerability allows unauthenticated attackers to perform arbitrary site option modifications via crafted HTTP requests.\nBy manipulating the 'option_name' and 'option_value' parameters within the vulnerable request, an attacker can modify sensitive WordPress core settings. In single-site configurations, this flaw facilitates a complete site compromise, typically through the enabling of user registrations and the modification of the 'default_role' option to 'administrator'.\nThis vulnerability is classified as an Unauthenticated Arbitrary Option Update, presenting an extreme risk to site integrity and confidentiality. Exploitation requires no special privileges or pre-existing user accounts, as the affected endpoint is exposed to the public internet without session verification or cryptographic proof of intent.\nSuccessful exploitation results in full administrative control over the affected WordPress instance. Remediation is strictly required to prevent unauthorized takeover and subsequent site-wide disruption or data exfiltration.",
  "technicalDetails": "The vulnerability resides in the core handling logic of the WP Component plugin, which exposes an action hook accessible to unauthenticated users. The root cause is the total absence of security measures—specifically, the lack of capability checks using current_user_can() and the failure to implement CSRF protection via nonces (wp_nonce_verify).\nUnder normal operations, WordPress 'options' are managed via the options table, which dictates site behavior, authentication settings, and registration workflows. The plugin processes incoming request parameters directly from the $_POST or $_GET global arrays, passing them into an internal function that interacts with the update_option() WordPress API function. Because the input parameters are not sanitized or validated against an allowlist of permitted options, an attacker can overwrite virtually any entry within the wp_options database table.\nThe attack flow proceeds as follows: 1. The attacker identifies the vulnerable endpoint, which is exposed to unauthenticated users. 2. The attacker crafts an HTTP request containing the targeted option key (e.g., 'users_can_register') and the desired malicious value (e.g., '1'). 3. The plugin receives the request, failing to verify the identity of the requester. 4. The plugin executes the update_option() function, effectively modifying the global site state. 5. To achieve full site takeover, an attacker repeats this process for the 'default_role' option, setting it to 'administrator'. 6. The attacker navigates to the standard WordPress registration URL (/wp-login.php?action=register) and creates a new account, which is automatically provisioned with administrative privileges due to the modified configuration.\nThis vulnerability is present in all versions of the WP Component plugin through 2.2.4. It is highly critical because it bypasses the entire WordPress authentication and authorization layer. The network exposure is total, as the plugin does not implement any IP restriction or WAF-integrated check. Once the option is modified, the impact is persistent, effectively granting the attacker a 'backdoor' administrative account. Because this modifies core WordPress configuration, the malicious changes persist even if the attacker logs out, necessitating a manual database cleanup to restore the original site settings."
}