EUVD-2020-30798
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
The AIT CSV import/export plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-content/plugins/ait-csv-import-export/admin/upload-handler.php file in versions up to, and including, 3.0.3. This makes it possible for unauthorized attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Analysis
The AIT CSV Import/Export WordPress plugin through version 3.0.3 allows unauthorized arbitrary file uploads without file type validation. The upload handler in upload-handler.php is accessible without authentication, enabling remote attackers to deploy PHP webshells and achieve code execution on the WordPress server.
Technical Context
The upload-handler.php in the plugin's admin directory processes file uploads without requiring WordPress authentication or validating file types. The file is stored in a web-accessible location. An attacker can upload a PHP file and access it directly to execute arbitrary code.
Affected Products
['AIT CSV Import/Export for WordPress <= 3.0.3']
Remediation
Remove the AIT CSV Import/Export plugin. If removal is not possible, block access to upload-handler.php at the web server level. Scan the uploads directory for PHP files and remove any found.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today