CVE-2015-1494

Vulnerability

The FancyBox for WordPress plugin versions before 3.0.3 fail to properly restrict access to the update action in wp-admin/admin-post.php. An attacker can inject arbitrary JavaScript via any mfbfw[*] parameter (e.g., mfbfw[padding]) in a POST request. The vulnerability was introduced due to insufficient input sanitization and lack of capability checks. Affected versions: all prior to 3.0.3.

Exploitation

An unauthenticated remote attacker can send a crafted POST request to wp-admin/admin-post.php with action=update and malicious mfbfw[*] parameters. No authentication or user interaction is required. The attack was observed in the wild in February 2015, with exploit attempts blocked by web application firewalls [3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the WordPress admin area, leading to cross-site scripting (XSS). This can be used to inject malicious iframes or scripts, compromise the site, and potentially escalate to full site takeover [3].

Mitigation

The vulnerability was fixed in version 3.0.3, released in February 2015 [2]. Users should immediately update to 3.0.3 or later. The plugin was temporarily removed from the WordPress repository during the incident [3]. No workaround is available; updating is the only mitigation.