Hello Greenshift Support Team,
I am contacting you regarding a security vulnerability that was identified during an authorized penetration test of one of our WordPress websites (www.norma-connect.de)
The issue appears to affect Greenshift Query 5.9.8 and specifically the REST endpoint:
/wp-json/greenshift/v1/get-dynamic-part
According to the security assessment, this endpoint can be accessed without authentication and accepts attacker-controlled dynamic field parameters. This makes it possible to query WordPress options and other internal data that should not be publicly accessible.
During the authorized assessment, the researchers were able to retrieve sensitive information, including WordPress option values, plugin credentials and secrets, SMTP-related authentication material, administrator password hashes, session metadata, and protected/private content. The report identifies the lack of appropriate authentication/capability checks and unrestricted dynamic field selection as the underlying issue.
The issue was independently reproduced during the security assessment, confirming that WordPress options could be disclosed through the Greenshift API without authentication.
We have temporarily mitigated the issue on our side by blocking access to the affected REST endpoint while we investigate further.
Could you please confirm:
- Whether you are already aware of this vulnerability.
- Whether a patched version is currently available or being prepared.
- Whether there are any other Greenshift REST endpoints that may be affected by the same authorization issue.
- What remediation you recommend for existing installations.
We have a detailed penetration-testing report containing reproduction information and technical evidence. Because the report contains security-sensitive information, I would prefer to provide it through a private security disclosure channel rather than include the full technical details in a general support ticket.
Please let me know the appropriate secure contact or process for submitting the complete report.
Kind regards,
Alvaro
Responses