PT-2018-12284 · WordPress+1 · Wordpress+1

Viniciusmarangoni · Published 2018-08-10 · Updated 2018-10-10 · CVE-2018-14028

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress version 4.9.7

Description The issue allows for the upload of PHP files via the admin area without proper verification as ZIP files. Once uploaded, even though the plugin extraction fails, the PHP file remains in a predictable location within wp-content/uploads, enabling an attacker to execute the file. This poses a security risk, particularly in scenarios where an attacker cannot upload arbitrary PHP code into a valid plugin ZIP file due to restricted permissions in the wp-content/plugins directory.

Recommendations For WordPress version 4.9.7, update to a version that includes the fix for this issue to prevent the upload and execution of unauthorized PHP files.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-14028

Affected Products

Debian

Wordpress

References · 15

• 🔥 https://github.com/rastating/wordpress-exploit-framework/pull/52 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14028 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14028 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14028 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14028 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14028 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14028 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/wordpress · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14028 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-14028 · Security Note
• http://securityfocus.com/bid/105060 · Note
• https://packages.debian.org/src:wordpress · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14028 · Note
• https://core.trac.wordpress.org/ticket/44710 · Note
• https://rastating.github.io/unrestricted-file-upload-via-plugin-uploader-in-wordpress · Note