THEMIS: New Fuzzing Tool for Finding Security Vulnerabilities in WordPress Plugins

WordPress is one of the most widely used content management systems for websites. Plugins are very popular among developers and users because they allow websites to be customized with functionality tailored to individual needs. “There are many plugins that can, for example, integrate calendars or other features into a website,” explains CISPA researcher Matteo Leonelli. “The downside, however, is that code is being added without people often knowing how it was tested or whether it is secure. The problem is that many developers focus more on functionality than on security.” This makes plugins an important attack surface for security vulnerabilities and logic errors within the WordPress ecosystem. Because existing web fuzzers have difficulty reaching the complex, context-aware execution paths of modern content management systems such as WordPress, the CISPA researcher and his colleagues developed a new fuzzing tool.

Context-Aware Fuzzing with THEMIS

“We decided not to focus on the WordPress core, but rather on the code of individual plugins,” says Leonelli. “This means we try to specifically examine the plugin logic while keeping everything else out of the way as much as possible.” To accomplish this, the researcher extended the ATROPOS fuzzing framework developed by his colleagues with several components specifically tailored to WordPress: domain-specific instrumentation of the WordPress core, an adaptive fuzzing harness that automatically identifies and targets different plugin entry points, and a specially developed bug oracle for detecting vulnerabilities typical of WordPress. “We use an oracle component that monitors the traffic between the two logic domains—the WordPress core and the plugin interface,” Leonelli explains. The goal is to guide the fuzzer specifically toward security-relevant parts of the code and uncover vulnerabilities there. THEMIS focuses on server-side vulnerabilities. Certain client-side security vulnerabilities, such as XSS, cannot currently be detected by the system.

Testing the Tool in Practice

For the evaluation, Leonelli examined 68 real-world WordPress plugins. THEMIS reproduced 27 known security vulnerabilities and additionally identified 10 previously unknown vulnerabilities, which were responsibly disclosed to the affected developers. Three of them were assigned their own CVE identifiers. In a direct comparison with ATROPOS, THEMIS found vulnerabilities faster, achieved greater coverage of the plugin code, and identified more relevant bugs. There were some limitations, however, with regard to false positives. “There is a trade-off here,” Leonelli explains. “You can find fewer bugs and be more confident that the bugs you find are real. Or you can accept somewhat less certainty and potentially detect edge cases that meet a certain threshold.” In addition to false positives, scalability also remains an area for improvement. Another major challenge in web fuzzing is execution speed. “Every time a request is sent, it first has to be generated, sent to the server, executed there, and then returned,” the researcher explains. “That is why web fuzzing is fundamentally slower than traditional fuzzing.”

Outlook

With his study, Leonelli demonstrates that existing general-purpose web fuzzers reach their limits when dealing with complex plugin ecosystems. Instead, he shows that a context-aware analysis tailored to WordPress’s architecture can achieve better results. With THEMIS, he provides an approach for automated security testing across large plugin ecosystems. THEMIS has been published on GitHub, allowing developers to install it and follow the instructions in the repository. “They can integrate their plugin into the infrastructure and test whether security vulnerabilities can be found in their plugin,” says Leonelli. In the future, he plans to focus more on projects that provide an interface between the client and server sides. He also sees the possibility of adapting THEMIS to other content management systems, provided the necessary conditions are met. 

• Scope: The study focuses on security vulnerabilities in WordPress plugins, with a particular focus on server-side vulnerabilities.
• Method: Researchers developed THEMIS, a context-aware grey-box fuzzing framework specifically tailored to WordPress. They evaluated it on 68 real-world plugins.
• Finding: THEMIS successfully reproduced 27 known vulnerabilities and discovered 10 previously unknown vulnerabilities.
• Impact: The results demonstrate the potential of context-aware fuzzing to improve automated security testing across large and diverse WordPress plugin ecosystems.