DefenseCode ThunderScan SAST Advisory
WordPress Tracking Code Manager Plugin
Multiple Security Vulnerabilities
Advisory ID: DC-2017-01-020
Advisory Title: WordPress Tracking Code Manager Plugin Multiple
Software: WordPress Tracking Code Manager
Software Language: PHP
Version: 1.11.1 and below
Vendor Status: Vendor contacted
Release Date: 2017-05-10
More information about ThunderScan is available at URL:
It has more than 40,000 downloads on wordpress.org.
During the security analysis, ThunderScan discovered Cross-Site
Scripting and remote Denial of Service vulnerabilities in Tracking
Code Manager plugin. Denial of Service requires only one visit to a
specific URL and whole WordPress becomes completely unresponsive until
restart. DoS is based upon the ability of the user to select and call
a function of it's choice (while safisfying specific conditions). By
making a recursive call to the function that handles the request
(tcmp_do_action()) DoS can easily be accomplished.
Both vulnerabilities can be found in the settings section of the
plugin, and can be remotely triggered due to missing nonce token and
validation. Since the DoS vulnerability relies on GET requests, is
missing the nonce token, the vulnerability is also directly exposed to
attack vectors such as Cross Site request forgery (CSRF).
DoS vulnerability was confirmed on windows OS.
3.1 Cross-Site Scripting
URL Parameter: tcmp_action
3.2. Denial of Service
Vendor should resolve the security issues in next release. All users
are strongly advised to update WordPress Tracking Code Manager plugin
to the latest available version as soon as the vendor releases an
Discovered with DefenseCode ThunderScan Source Code Security Analyzer
by Neven Biruski
04/04/2017 Vendor contacted
07/04/2017 Vendor responded: "We will fix it in the next update"
10/05/2017 Advisory released to the public
DefenseCode L.L.C. delivers products and services designed to analyze
and test web, desktop and mobile applications for security
DefenseCode ThunderScan is a SAST (Static Application Security
Testing, WhiteBox Testing) solution for performing extensive security
audits of application source code. ThunderScan SAST performs fast and
accurate analyses of large and complex source code projects delivering
precise results and low false positive rate.
DefenseCode WebScanner is a DAST (Dynamic Application Security
Testing, BlackBox Testing) solution for comprehensive security audits
of active web applications. WebScanner will test a website's security
by carrying out a large number of attacks using the most advanced
techniques, just as a real attacker would.
Subscribe for free software trial on our website