PT-2019-7415 · Orbisius · Orbisius-Child-Theme-Creator

Mika · Published 2019-10-07 · Updated 2019-10-10 · CVE-2015-9456

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions orbisius-child-theme-creator plugin versions prior to 1.2.8

Description The issue concerns incorrect access control for file modification. It can be exploited via the wp-admin/admin-ajax.php?action=orbisius ctc theme editor ajax&sub cmd=save file endpoint, specifically through the theme 1, theme 1 file, or theme 1 file contents parameters.

Recommendations For versions prior to 1.2.8, update to version 1.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-admin/admin-ajax.php?action=orbisius ctc theme editor ajax&sub cmd=save file endpoint to minimize the risk of exploitation.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2015-9456

Affected Products

Orbisius-Child-Theme-Creator

References · 6

• 🔥 http://cinu.pl/research/wp-plugins/mail_28c91eee00e8e4b5868ebc58b5b1f730.html · Exploit
• 🔥 https://wpvulndb.com/vulnerabilities/8315 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9456 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9456 · Note
• https://wordpress.org/plugins/orbisius-child-theme-creator/#developers · Note
• https://t.me/cibsecurity/7266 · Telegram Post