HTML Injection Vulnerability in WordPress Plugin WPForms

Security researchers from aramido uncovered an HTML injection security vulnerability in the WordPress plugin WPForms from the company of the same name. The plugin allows users of the very widespread content management system WordPress to easily create forms, such as a contact form. Security vulnerabilities like this occur repeatedly on websites with input fields, although they have long been considered one of the most common security risks for web applications . In accordance with aramido's guidelines for the responsible disclosure of security vulnerabilities , aramido reported the vulnerability to the manufacturer for remediation, which according to WPForms, LLC. has since taken place. The security advisory formulated by aramido can also be viewed publicly.

A WordPress contact form created with WPForms from the template Simple Contact Form consists of the fields Name, Email and Comment or Message. When the contact form is filled out and submitted, an email containing the contents of the three fields is sent to a predefined recipient. In this process, WPForms filters out HTML tags using the WordPress function sanitize_text_field. This filtering removes recognized HTML tags from the message, however, this filtering is only performed once, which enabled an HTML injection. By nested injection of further HTML tags, the security researchers from aramido were able to bypass the filtering. The email sent by WPForms to the predefined recipient could thus have been equipped with forged content, such as a "click here to reply" button, luring the recipient to a prepared phishing page.

To remediate a vulnerability of this type, it is necessary to improve at the following levels:

1. Validation of all user inputs with appropriate error handling.
2. Escaping the contents according to the target system, in this case HTML.

The found vulnerability was detected in version 1.5.9.5 of WPForms. The update to the corrected version 1.6.0.1 is available for installation in WordPress. aramido has checked the new version and could no longer detect the security vulnerability in this form. Furthermore, aramido recommends performing hardening measures , i.e., further securing the own IT system against the attack described here and, for example, displaying emails containing content from publicly accessible fields as plain-text emails.