CVE-2020-35234: Easy WP SMTP Authentication Bypass Flaw

CVE-2020-35234 Overview

CVE-2020-35234 is an Information Exposure vulnerability in the Easy WP SMTP plugin for WordPress that allows attackers to take over Administrator accounts. The vulnerability exists in versions prior to 1.4.4 and was actively exploited in the wild in December 2020. When directory listing is enabled on the vulnerable plugin directory, attackers can discover debug log files containing sensitive password-reset links, enabling complete administrative account compromise.

Critical Impact
Attackers exploiting this vulnerability can gain full administrative access to WordPress installations by intercepting password-reset links logged in accessible debug files, leading to complete site takeover.

Affected Products

Easy WP SMTP plugin for WordPress versions prior to 1.4.4
WordPress installations with Easy WP SMTP plugin and directory listing enabled
wp-ecommerce easy_wp_smtp

Discovery Timeline

2020-12-14 - CVE-2020-35234 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-35234

Vulnerability Analysis

This vulnerability falls under CWE-532 (Insertion of Sensitive Information into Log File). The Easy WP SMTP plugin logs all email communications, including password-reset links, to a debug log file stored in a predictable location within the plugin directory. When web servers are configured to allow directory listing of the wp-content/plugins/easy-wp-smtp/ directory, attackers can enumerate and access these log files.

The attack is particularly dangerous because it requires no authentication and can be executed remotely over the network. The log file naming convention follows a pattern with a numeric prefix followed by _debug_log.txt, making enumeration feasible. Once an attacker obtains a valid password-reset link from these logs, they can reset the administrator password and gain complete control of the WordPress installation.

Root Cause

The root cause of this vulnerability is improper handling of sensitive information in debug logging functionality. The plugin stores password-reset links in plain text within log files that are placed in a web-accessible directory without adequate access controls. This design flaw violates the principle of secure logging by not sanitizing sensitive data before logging and failing to protect log files from unauthorized access.

Attack Vector

The attack vector is network-based and requires the following conditions:

The target WordPress site must have the Easy WP SMTP plugin (version < 1.4.4) installed
Directory listing must be enabled on the web server for the plugin directory
Debug logging must be active in the plugin configuration

An attacker would first attempt to access wp-content/plugins/easy-wp-smtp/ to list directory contents. Upon discovering a log file matching the pattern #############_debug_log.txt, they can download and parse it for password-reset URLs. The attacker then initiates a password reset for the administrator account through the WordPress login page and retrieves the reset link from the exposed log file to complete the account takeover.

Detection Methods for CVE-2020-35234

Indicators of Compromise

Unusual HTTP GET requests to /wp-content/plugins/easy-wp-smtp/ directory
Access attempts to files matching *_debug_log.txt pattern in plugin directories
Multiple password reset requests followed by successful logins from unknown IP addresses
Unauthorized administrative actions following password reset events

Detection Strategies

Monitor web server access logs for directory listing requests targeting plugin directories
Implement file integrity monitoring on WordPress plugin directories to detect unauthorized access to log files
Configure alerting for password reset requests followed by logins from geographically inconsistent IP addresses
Use web application firewall (WAF) rules to block direct access to debug log files

Monitoring Recommendations

Enable verbose logging on WordPress authentication events and correlate with web server access logs
Deploy endpoint detection to identify post-exploitation activities following account compromise
Implement real-time monitoring of administrative user creation and privilege escalation events
Regularly audit plugin directory permissions and server configurations for directory listing exposure

How to Mitigate CVE-2020-35234

Immediate Actions Required

Update the Easy WP SMTP plugin to version 1.4.4 or later immediately
Disable directory listing on the web server for all WordPress directories
Delete any existing debug log files from the plugin directory
Review administrator account activity for signs of unauthorized access
Reset all administrator passwords as a precautionary measure

Patch Information

The vulnerability was addressed in Easy WP SMTP plugin version 1.4.4. Site administrators should update through the WordPress plugin management interface or download the patched version directly from the WordPress Plugin Directory. Additional technical details about the fix are available in the NinTechNet security advisory.

Workarounds

Disable directory listing by adding Options -Indexes to .htaccess in the WordPress root directory
Restrict access to the plugin directory using web server configuration rules
Disable debug logging in the Easy WP SMTP plugin settings until the update can be applied
Implement IP-based access restrictions for WordPress administrative functions

bash

# Apache .htaccess configuration to disable directory listing
# Add to WordPress root .htaccess file
Options -Indexes

# Block direct access to log files in plugins directory
<FilesMatch "\.txt$">
    Order deny,allow
    Deny from all
</FilesMatch>