Lucene search
Ericfrank900528WPEX-ID:AD99B9BA-5F24-4682-A787-00F0E8E32603HistoryApr 11, 2022 - 12:00 a.m.
Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
2022-04-1100:00:00
ericfrank900528
75
wordpress
admin
file upload
remote code execution
vulnerability
exploit
security advisory
EPSS
0.001
Percentile
42.9%
The plugin does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
Import a PHP file via an URL [Tools > Import WP > Add Importer (put any name, and post template) > Create Importer > Remote File (select any file type)], eg: https://example.com/info.php (content of info.php:<?php phpinfo();?>)
Intercept the response to get the path of the file (via the file[src], eg: 06-2-info.php) and append that https://WP/wp-content/uploads/<year>/<month>, eg: https://WP/wp-content/uploads/2022/04/06-2-info.phpRelated
cnvd
cnvd
WordPress Import WP plugin file upload vulnerability
2022-05-07 00:00:00
wpvulndb
wpvulndb
Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
2022-04-11 00:00:00
cve
cve
CVE-2022-1273
2022-05-02 16:15:09
nvd
nvd
CVE-2022-1273
2022-05-02 16:15:09
prion
prion
Design/Logic Flaw
2022-05-02 16:15:00
patchstack
patchstack
cvelist
cvelist
CVE-2022-1273 Import WP < 2.4.6 - Admin+ Arbitrary File Upload to RCE
2022-05-02 16:05:55