Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability allows unauthenticated attackers to upload malicious files to a WordPress website. By exploiting a specific function within the Download From Files plugin, attackers can bypass security checks and place harmful executables on the server, potentially leading to a full compromise.
- Websites using this plugin are at risk.
- Attackers can gain control of the web server.
- The issue is reachable from the internet.
Attack Path
How an attacker could exploit the issue
Unauthenticated attackers can exploit this flaw by targeting the `admin-ajax.php` endpoint in the WordPress Plugin Download From Files, version 1.48 and earlier. By manipulating parameters, they can upload and execute malicious files on the web server, gaining control.
- Targets `admin-ajax.php` endpoint.
- Uploads malicious PHP shells.
- No authentication required.
Live Threat
Current exploitation, exposure, and threat context
This arbitrary file upload vulnerability in a popular WordPress plugin is a significant concern for exposed web servers. Attackers can leverage this flaw to upload malicious files, potentially leading to full system compromise without prior authentication. The widespread use of WordPress and the direct accessibility of the vulnerable endpoint make it an attractive target.
- Unauthenticated remote code execution possible.
- Public exploit code exists.
- Vulnerability is relatively recent.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate containment for the WordPress Download From Files plugin, as unauthenticated users can upload malicious files. Review logs for exploitation attempts targeting the admin-ajax.php endpoint and analyze the reachability of affected services.
- Block traffic to admin-ajax.php.
- Isolate affected WordPress instances.
- Monitor for unusual file uploads.
