CVE-2020-35234: 
WordPress vulnerability analysis and mitigation

The easy-wp-smtp plugin before 1.4.4 for WordPress, with over 500,000 active installations, contained a critical vulnerability (CVE-2020-35234) that allowed unauthenticated attackers to perform administrator account takeover. The vulnerability was discovered and disclosed in December 2020 and was actively exploited in the wild (NinTechNet Blog).

The vulnerability existed in the plugin's debug log functionality, where email messages including password reset links were stored in a text file with a random name (e.g., #############_debug_log.txt) within the plugin's directory. Due to missing index.html file in the plugin's folder, if directory listing was enabled on the server, attackers could discover and access the debug log file containing sensitive information. The vulnerability received a CVSS v3.1 Base Score of 7.5 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (NVD).

When exploited, the vulnerability allowed attackers to gain unauthorized access to administrator accounts by intercepting password reset links from the debug log. Once administrative access was obtained, attackers could take complete control of the WordPress site, including installing rogue plugins (NinTechNet Blog).

The vulnerability was actively exploited in the wild during December 2020. The exploitation process involved finding the debug log file, performing username enumeration to identify admin users, requesting a password reset, and using the intercepted reset link from the debug log to take over the administrator account (NinTechNet Blog).

The vulnerability was patched in version 1.4.4 of the Easy WP SMTP plugin. Site administrators were advised to update immediately if running version 1.4.2 or below. Additionally, it was recommended to disable the debug log feature as it could leak sensitive information. Users of NinjaFirewall WP Edition (free) and NinjaFirewall WP+ Edition (premium) were protected against this vulnerability (NinTechNet Blog, WordPress Plugin).