Description
The Bug Library WordPress plugin before version 2.1.1 does not validate the file type of attachments submitted via the public bug-report form, allowing an unauthenticated attacker to upload an arbitrary PHP file and achieve remote code execution.
When the "Allow Attachments" setting is enabled and CAPTCHA is either disabled or not deployed, a PHP webshell can be submitted as a bug report attachment. The file is stored under wp-content/uploads/bug-library/ and is directly accessible over HTTP, giving the attacker a persistent shell on the server.
Affected versions: Bug Library < 2.1.1 CVSSv3 Score: 10.0 (Critical) - CWE-434: Unrestricted Upload of File with Dangerous Type
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/unix/webapp/wp/bug_library_file_uploadmsf undefined(bug_library_file_upload) > show actions ...actions...msf undefined(bug_library_file_upload) > set ACTION < action-name >msf undefined(bug_library_file_upload) > show options ...show and set options...msf undefined(bug_library_file_upload) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub