Oraculo Plugin — Exposed Credentials

Hardcoded Credentials

Password: SNAPsitio30v
Salt: ALRTOPER984TNMGDGFDH

Used in MCrypt encrypt()/decrypt() functions for data encryption between the oraculo centralized management server and individual government WordPress sites.

Impact

The Sitio-32 theme with oraculo plugin is deployed across ALL Ecuador government WordPress sites including:

presidencia.gob.ec (Presidency)
vicepresidencia.gob.ec (Vice Presidency)
comunicacion.gob.ec (Government Communications)
ecu911.gob.ec (Emergency Services)
arcotel.gob.ec (Telecom Regulator)
aduana.gob.ec (Customs)
And potentially hundreds more .gob.ec domains

The shared password and salt could allow:

Decryption of all data encrypted by the oraculo plugin
Forgery of encrypted payloads to inject content
Combined with SQL injection vectors in the same theme, full database compromise

SQL Injection Vectors

ajax_selects.php

$id = $_POST['identificador'];
"...where relacion=" . $id . "..."

procesarContacto.php

$nombre = $_POST['nombre'];
"INSERT INTO contacto (nombre, apellido, cedula...) VALUES('$nombre','$apellido'..."

Additional Findings

MCrypt is deprecated since PHP 7.1 (removed in PHP 7.2)
No CSRF protection on form handlers
No input validation/sanitization
Unsafe email headers allowing header injection
Mobile-Detect 2.8.17 bundled (older version)