The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.
The 'Tnc_Wp_Toolbox_Settings::save_settings' function saves cPanel API credentials to files in the wp-content directory, which is publicly accessible through a web browser by default. The lack of proper protection mechanisms (such as .htaccess file or authentication) means that any network user can read these files without needing any permissions. The obtained credentials allow an attacker to directly interact with the cPanel API, opening the door to attack escalation.
An attacker can read cPanel API credentials and use them to upload arbitrary files, execute remote code (RCE), and fully compromise the hosting environment, including all services and data hosted on it.
The plugin should be updated to a version containing the fix published in commit 31bb3040b22c84e2d6dfd3210fe0ad045ff4ddf6 in the vendor's repository. It is also recommended to immediately rotate API keys and cPanel credentials that may have been exposed in vulnerable installations.
TNC Toolbox: Web Performance plugin for WordPress in all versions up to and including 1.4.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H