Vulnerability in AccelerateWP component in cPanel on CloudLinux OS – cPanel

Situation

A vulnerability has been discovered in AccelerateWP, a component of CloudLinux OS, that allows unauthenticated remote attackers to download a backup of the WordPress configuration file (wp-config.php.backup) from the document root of affected websites.

Affected Product Versions

Product	Affected Versions	Patched Versions
AccelerateWP (CloudLinux OS)	AccelerateWP v1.9-37 or earlier	AccelerateWP v1.9-38 or higher

Impact

Websites with Redis Object Cache enabled that have a wp-config.php.backup file present in their document root risk exposing sensitive information, such as database credentials and security keys, to unauthenticated remote attackers.

Websites that have never had the Object Cache feature enabled, or where no backup file was generated, are not affected.

Call to action

A patch has been released correcting this vulnerability. The following steps will guide you through updating AccelerateWP and then updating the credentials of any affected users:

1. Apply security patch

For CloudLinux OS 7:

# yum update accelerate-wp

For CloudLinux OS 8/9:

# dnf update accelerate-wp

2. Rotate compromised credentials

Generate a list of affected users:

# find /home -type f -name "wp-config.php.backup" > /root/affected_users_list.txt

Remove corresponding wp-config.php.backup files and reset database user passwords for affected websites.

3. Regenerate WordPress security keys & salts

Use WordPress generator at https://api.wordpress.org/secret-key/1.1/salt/ and update the corresponding block in wp-config.php:

CONFIG_TEXT: define( 'AUTH_KEY', 'put your unique phrase here' );
define( 'SECURE_AUTH_KEY', 'put your unique phrase here' );
define( 'LOGGED_IN_KEY', 'put your unique phrase here' );
define( 'NONCE_KEY', 'put your unique phrase here' );
define( 'AUTH_SALT', 'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT', 'put your unique phrase here' );
define( 'NONCE_SALT', 'put your unique phrase here' );