Possible Security Risk in WordPress Plugin Groups
Description
How a WP user with user role editor and custom capability ‚groups_admin_groups‘ could gain almost admin level.
Test Environment
WordPress Version 3.9.3
WP Plugin Groups Version 1.4.12
Test Scenario
In a website project a WordPress User of a user role lower than admin (author, contributor, editor) should confirm user registrations and be able to group users with the WP Plugin Groups.
This is possible, if the user is granted the core capability ‚promote_users‚ (necessary as described in WP support)and the custom capabilities (coming with the groups plugin) ‚groups_access‚ and ‚groups_admin_groups‚
Without these two capabilities, it is not possible to
- create new groups
- add users to groups
Security Risk: User can gain near Admin capabilities
Now the user with restricted capabilities is allowed to create a new group. While adding a new or editing an existing group the user can add capabilities to this group.
Creating a super group with all core capabilities
The capabilities are not restricted by the user role of the current user. It is possible to add ALL core capabilities (including create user, delete user, switch theme, delete them, and more) and all custom capabilities and even create new capabilities.
Change group membership in profile
After adding all capabilities to a test group, the user could save this, access his own profile and make himself member of this test group. Save and reload and welcome the new almost admin with full system access. The only difference, that a member of this super group is not member of the user role Administrator, not able to list and dreate and delete other admins.
If a user is given a role with restricted capabilities this might happen for some reason, but perhaps not intended is a scenario of a self-empowered user with almost admin rights
BUG FIX (QUICK):
FILE:/wp-content/plugins/groups/lib/core/constants.php
Add the following at around LINE 62::/**
* @var string grants access to add and edit capabilities
*/
define( 'GROUPS_ADMINISTER_CAPABILITIES', 'groups_admin_groups_capabilities');
To define a new capability accessible through Plugin User Role Editor
And Groups Options (For Admins)
FILE: /wp-content/plugins/groups/lib/admin/groups-admin-capabilities.php
After:function groups_admin_capabilities() {
global $wpdb;
$output = '';
$today = date( 'Y-m-d', time() );
if ( !current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
}
at around LINE 50 add the following: if ( !current_user_can( GROUPS_ADMINISTER_CAPABILITIES ) ) {
wp_die( __( 'Access denied.', GROUPS_PLUGIN_DOMAIN ) );
}
FILE: /wp-content/plugins/groups/lib/admin/groups-admin-groups-edit.php
Check for (at around LINE 100:)
$capability_table = _groups_get_tablename( 'capability' );
and add//START CAPABILITIES
if ( current_user_can( GROUPS_ADMINISTER_CAPABILITIES ) ) {
before
and close brackets at around LINE 139 after$output .= Groups_UIE::render_select( '.select.capability' );
add line}//END CAPABILITIES
FILE: /wp-content/plugins/groups/lib/admin/groups-admin-groups-add.php
Before the following Lines (at around LINE 90):
$output .= '<div class="field">';
$capability_table = _groups_get_tablename( "capability" );</div>
Insert:
//START CAPABILITIES
if ( current_user_can( GROUPS_ADMINISTER_CAPABILITIES ) ) {
and close brackets at around Line 117 after:
$output .= Groups_UIE::render_select( '.select.capability' );
$output .= '</div>';
with:}//END CAPABILITIES
FILE: /wp-content/plugins/groups/lib/admin/groups-admin-options.php
At around Line 50 change:
$caps = array(
GROUPS_ACCESS_GROUPS => __( 'Access Groups', GROUPS_PLUGIN_DOMAIN ),
GROUPS_ADMINISTER_GROUPS => __( 'Administer Groups', GROUPS_PLUGIN_DOMAIN ),
GROUPS_ADMINISTER_OPTIONS => __( 'Administer Groups plugin options', GROUPS_PLUGIN_DOMAIN ),
);
To:
$caps = array(
GROUPS_ACCESS_GROUPS => __( 'Access Groups', GROUPS_PLUGIN_DOMAIN ),
GROUPS_ADMINISTER_GROUPS => __( 'Administer Groups', GROUPS_PLUGIN_DOMAIN ),
GROUPS_ADMINISTER_CAPABILITIES => __( 'Administer Groups Capabilities', GROUPS_PLUGIN_DOMAIN ),
GROUPS_ADMINISTER_OPTIONS => __( 'Administer Groups plugin options', GROUPS_PLUGIN_DOMAIN ),
);
As Admin (Or with the capability groups_administer_options) you could now acces the Groups->Options page and check the new capability GROUPS_ADMINISTER_CAPABILITIES for the User Role Administrator
Groups->Options
User Role Editor
Bugfix (Only modified files)
Here you can download the modified files