Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution

2022-11-2900:00:00

Anton Sarsadskikh

admin access

visibility control

php code execution

menu vulnerability

0.001 Low

EPSS

Percentile

44.7%

JSON

The plugin doesn’t sanitize and validate the “Visibility logic” option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.

1. As an admin, go to "Appearance -> Menus" and create a menu with some items of your choice.

2. In the "Menu structure" click on any item (the arrow down on the right of 'Page') and locate "Visibility logic" field.

3. Add the following code in the field: file_put_contents('/var/www/hacked.php', '<?php echo "failed"; ?>')

4. After saving changes and navigating to the menu's location, the visibility logic triggers executing our payload.

0.001 Low

EPSS

Percentile

44.7%

JSON

Related for WPEX-ID:EAA28832-74C1-4CD5-9B0F-02338E23B418