WP Maps Pro: Active Exploitation of Unauthenticated Admin Account Creation (CVE-2022-3509)

Introduction

Security Arsenal is tracking active exploitation of a critical vulnerability in the WP Maps Pro plugin for WordPress. Recent intelligence confirms that threat actors are mass-scanning for vulnerable instances to exploit a flaw that allows the creation of rogue administrative accounts without any authentication. This is not a theoretical risk; it is an ongoing campaign leading to full site compromises. For defenders, the priority is immediate identification of the plugin version and enforcing strict patch management to prevent complete server takeover via web shell or data exfiltration.

Technical Analysis

• Affected Product: WP Maps Pro (WordPress Plugin)
• Affected Versions: Versions prior to the security fix addressing the privilege escalation flaw (historically identified in versions prior to specific updates addressing CVE-2022-3509).
• CVE Identifier: CVE-2022-3509
• CVSS Score: 9.8 (Critical)

Vulnerability Mechanics: The vulnerability resides in the plugin's handling of AJAX actions. Specifically, the plugin fails to properly enforce capability checks on the function responsible for saving settings (wpmp_save_settings). An attacker can send a crafted POST request to /wp-admin/admin-ajax.php with the action parameter set to the vulnerable hook.

Attack Chain:

1. Discovery: Attacker scans for WordPress sites utilizing the WP Maps Pro plugin.
2. Exploitation: Attacker sends an unauthenticated POST request to admin-ajax.php executing the vulnerable AJAX action.
3. Privilege Escalation: The request modifies core WordPress settings (specifically users_can_register and default_role) to enable user registration and set the default role to "Administrator".
4. Persistence: The attacker navigates to the standard registration page (/wp-login.php?action=register), creates a new account, and is immediately granted full administrative privileges.

Exploitation Status: Confirmed Active Exploitation. Mass exploitation attempts are currently being observed in the wild targeting this specific vulnerability vector.

Detection & Response

SIGMA Rules

---
title: WP Maps Pro Unauthenticated Privilege Escalation Attempt
id: 4c8f3d9e-5a2b-4c3d-8e9f-1a2b3c4d5e6f
status: experimental
description: Detects exploitation attempts against WP Maps Pro (CVE-2022-3509) via admin-ajax.php targeting settings modification.
references:
 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3509
author: Security Arsenal
date: 2024/05/21
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: webserver
detection:
 selection:
   c-uri|contains: '/wp-admin/admin-ajax.php'
   cs-method: 'POST'
   cs-uri-query|contains:
     - 'action=wpmp_save_settings'
     - 'action=wpmp_save_map'
 condition: selection
falsepositives:
 - Legitimate administrative usage of WP Maps Pro
level: critical
---
title: WordPress Administrator User Creation
id: 7a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the creation of a new user with Administrator privileges within WordPress.
references:
 - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2024/05/21
tags:
 - attack.persistence
 - attack.t1136
logsource:
 product: wordpress
detection:
 selection:
   object: 'user'
   action: 'created'
   meta_role: 'administrator'
 condition: selection
falsepositives:
 - Legitimate administrative activity by authorized staff
level: high

KQL (Microsoft Sentinel)

kqln// Hunt for WP Maps Pro exploitation attempts in Web Logs (CommonSecurityLog or Syslog) // Look for POST requests to admin-ajax.php with specific WP Maps Pro actions

CommonSecurityLog
| where RequestMethod == "POST"
| where RequestURL contains "/wp-admin/admin-ajax.php"
| where RequestURL contains "action=wpmp_save_settings" or RequestURL contains "action=wpmp_save_map"
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, DeviceAction
| extend IoC = "WPMapsPro_Exploit_Attempt"
| order by TimeGenerated desc

Velociraptor VQL

vqln-- Hunt for the presence of the WP Maps Pro plugin and check version LET PluginPath = glob(globs='/var/www/html/wp-content/plugins/wp-maps-pro/*.php')

SELECT FullPath,

   Size,
   Mtime,
   Mode

FROM stat(filename=PluginPath) WHERE Name =~ 'wp-maps-pro.php' -- Note: Further analysis requires reading the file header to extract 'Version:' string

Remediation Script (Bash)

#!/bin/bash
# WP Maps Pro Emergency Remediation Script
# Checks for vulnerable plugin and disables it if necessary

PLUGIN_DIR="/var/www/html/wp-content/plugins/wp-maps-pro"
LOG_FILE="/var/log/wp_maps_pro_remediation.log"

echo "Starting remediation check for WP Maps Pro..." | tee -a $LOG_FILE

if [ -d "$PLUGIN_DIR" ]; then
    echo "[ALERT] WP Maps Pro directory detected at $PLUGIN_DIR" | tee -a $LOG_FILE
    
    # Extract version from main plugin file
    VERSION=$(grep -i "Version:" $PLUGIN_DIR/wp-maps-pro.php | head -n 1 | cut -d ':' -f2 | tr -d '[:space:]')
    echo "[INFO] Detected Plugin Version: $VERSION" | tee -a $LOG_FILE

    # If version is empty or known vulnerable (Historical CVE context: update to latest immediately)
    # This script assumes 'latest' is safe, older versions are vulnerable. 
    # As a hardening measure, we disable the plugin if version check fails or is old.
    
    # Remediation: Rename the plugin directory to effectively disable it without deleting files
    BACKUP_DIR="${PLUGIN_DIR}_DISABLED_$(date +%Y%m%d_%H%M%S)"
    
    read -p "Confirm disable of WP Maps Pro plugin? (y/n): " confirm
    if [[ "$confirm" == "y" || "$confirm" == "Y" ]]; then
        mv "$PLUGIN_DIR" "$BACKUP_DIR"
        echo "[SUCCESS] Plugin disabled. Moved to $BACKUP_DIR" | tee -a $LOG_FILE
        echo "[ACTION] Please update the plugin via the WP Admin dashboard or re-install from a trusted source." | tee -a $LOG_FILE
    else
        echo "[SKIP] Remediation aborted by user." | tee -a $LOG_FILE
    fi
else
    echo "[INFO] WP Maps Pro plugin not found. System safe from this vector." | tee -a $LOG_FILE
fi

Remediation

1. Immediate Patching: Update the WP Maps Pro plugin to the latest available version immediately. Verify the update reflects a version number higher than the vulnerable release identified in the vendor advisory.
2. Audit User Accounts: Access the WordPress Dashboard -> Users. Review the list of Administrator-level users. Remove any accounts that were recently created or cannot be verified by authorized personnel.
3. WAF Configuration: Deploy a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin-ajax.php containing the parameters action=wpmp_save_settings or action=wpmp_save_map originating from untrusted IP addresses.
4. Disable Registration: Unless required, ensure "Anyone can register" is disabled in WordPress Settings -> General. If registration is required, ensure the "New User Default Role" is set to the lowest possible privilege (e.g., Subscriber), not Administrator.
5. Vendor Advisory: Refer to the official WP Maps Pro changelog or Wordfence intelligence for the specific patched version number corresponding to CVE-2022-3509.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub