PT-2021-3844 · WordPress · Motor

Harald Eilertsen · Published 2021-05-12 · Updated 2021-07-09 · CVE-2021-24375

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Motor WordPress theme versions prior to 3.1.0

Description The issue is related to a lack of authentication or validation in certain AJAX handlers, specifically motor load more, motor gallery load more, motor quick view, and motor project quick view, which can allow an unauthenticated attacker to access arbitrary files on the server file system and execute arbitrary PHP scripts already present on the server. There is no vulnerability found for uploading files with this theme, meaning any executable scripts must already exist on the server.

Recommendations For Motor WordPress theme versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the motor load more, motor gallery load more, motor quick view, and motor project quick view functions until a patch is applied. Restrict access to these AJAX handlers to minimize the risk of exploitation.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

CWE-36

Related Identifiers

BDU:2021-04199

CVE-2021-24375

Affected Products

Motor

References · 7

• 🔥 https://jetpack.com/2021/06/09/motor-wordpress-theme-vulnerabilities · Exploit
• 🔥 https://wpscan.com/vulnerability/d9518429-79d3-4b13-88ff-3722d05efa9f · Exploit
• https://bdu.fstec.ru/vul/2021-04199 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24375 · Security Note
• https://t.me/cvenotify/17118 · Telegram Post
• https://vuldb.com/?id.177991 · Note