Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in a WordPress plugin, specifically the Snazzy Social Media Feed plugin, that allows for arbitrary file uploads. This issue could enable unauthorized code execution on affected systems. The main concern is to confirm if this plugin is in use within our organization and to what extent it might be exposed.
- Attackers can upload malicious files.
- Confirms plugin relevance and potential exposure.
- Assess and mitigate usage of this plugin.
Attack Path
How an attacker could exploit the issue
An attacker can upload a malicious file to a WordPress site by leveraging a vulnerability in the Snazzy Social Media Feed plugin. This is possible because the plugin's `save-to-cache.php` script, which is accessible without needing to load WordPress fully, fails to properly check for authorization or verify the input. By manipulating a parameter, an attacker can cause the script to write an executable PHP file to the server, which can then be run remotely.
- Attacker uploads malicious file directly.
- Vulnerable script processes unverified input.
- Allows remote code execution.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an attacker to upload and execute arbitrary PHP code on a WordPress site by exploiting the Snazzy Social Media Feed plugin's `save-to-cache.php` script. This script, which is directly accessible without WordPress loading, lacks proper security checks and sanitizes user input insufficiently, enabling the creation of executable files.
- Website files and server access.
- Authenticated users uploading malicious files.
- Complete server takeover.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Snazzy Social Media Feed WordPress plugin's arbitrary file upload vulnerability requires immediate attention from teams managing WordPress instances. The first step is to identify all deployments, determine their exposure and criticality, and then assign ownership for remediation.
- WordPress administrators and platform owners.
- Verify WordPress sites using the affected plugin.
- Plan vendor-coordinated updates and controls.
