Analysis of the Fancybox-For-WordPress Vulnerability  ## Metadata - Author: [[Marc-Alexandre Montpas]] - Full Title: Analysis of the Fancybox-For-WordPress Vulnerability - Category: #articles - Summary: We were alerted last week of a malware outbreak affecting WordPress sites using version 3.0.2 and lower of the fancybox-for-wordpress plugin. As announced, here are some of the details explaining how attackers could use this vulnerability to inject malicious iframes on websites using this plugin. - URL: https://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulnerability.html We were [alerted last week of a malware outbreak affecting WordPress sites](https://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html) using version 3.0.2 and lower of the **[fancybox-for-wordpress](https://wordpress.org/plugins/fancybox-for-wordpress/)** plugin. As announced, here are some of the details explaining how attackers could use this vulnerability to inject malicious iframes on websites using this plugin. #### Technical details This vulnerability exploited a somewhat well-known attack vector amongst WordPress plugins: **unprotected “admin\_init” hooks**. [](https://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulnerability.html/sucuri-fancybox-wordpress-code1) As **“admin\_init”** hooks can be called by anyone visiting either **/wp-admin/admin-post.php** or **/wp-admin/admin-ajax.php**, this snippet could be used by remote attackers to change the plugin’s **“mfbfw”** option with any desired content. This got us asking ourselves, what was this option used for? [](https://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulnerability.html/sucuri-fancybox-wordpress-code2) We found that this option was being used in **many** **places** within the plugins codebase. The one that caught our attention was inside the **mfbfw\_init()** function. This basically displays jQuery scripts configured to work with parameters that were set up earlier, in **mfbfw\_admin\_options()**. [](https://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulnerability.html/sucuri-fancybox-wordpress-code3) As you can see from the above picture, the **$settings** array is not sanitized before being output to the client, which means an attacker, using the unprotected **“admin\_init”** hook, could inject malicious Javascript payloads into every page of a vulnerable website, such as the “**203koko”** iframe injection [we presented last week.](https://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html), Analysis of the Fancybox-For-WordPress Vulnerability, Marc-Alexandre Montpas, 01gnmczfgq67kymtrvvw6ymywp.