Vulnerability in AccelerateWP component in Plesk on CloudLinux OS

Situation

A vulnerability has been discovered in AccelerateWP, a component of CloudLinux OS, that allows unauthenticated remote attackers to download a backup of the WordPress configuration file (wp-config.php.backup) from the document root of affected websites.

Affected product versions

Impact

Websites with Redis Object Cache enabled that have a wp-config.php.backup file present in their document root risk exposing sensitive information, such as database credentials and security keys, to unauthenticated remote attackers.

Websites that have never had the Object Cache feature enabled, or where no backup file was generated, are not affected.

Call to action

1. Apply the security update:

   CloudLinux OS 7

   # yum update accelerate-wp

   CloudLinux OS 8/9

   # dnf update accelerate-wp

2. Rotate any compromised credentials:

   Generate a list of affected users:

   # find /var/www/vhosts -type f -name "wp-config.php.backup" > /root/affected_users_list.txt

   Remove the corresponding wp-config.php.backup files and reset the database user passwords for the affected websites.

3. Regenerate the WordPress security keys and salts:

   Use the WordPress generator at https://api.wordpress.org/secret-key/1.1/salt/ and replace the corresponding block in wp-config.php:

   CONFIG_TEXT: define( 'AUTH_KEY', 'put your unique phrase here' );
   define( 'SECURE_AUTH_KEY', 'put your unique phrase here' );
   define( 'LOGGED_IN_KEY', 'put your unique phrase here' );
   define( 'NONCE_KEY', 'put your unique phrase here' );
   define( 'AUTH_SALT', 'put your unique phrase here' );
   define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
   define( 'LOGGED_IN_SALT', 'put your unique phrase here' );
   define( 'NONCE_SALT', 'put your unique phrase here' );