Arbitrary File Deletion in JS Help Desk WordPress Plugin

Executive Summary

This vulnerability is in the JS Help Desk WordPress plugin. It allows authenticated attackers with admin access to delete arbitrary files on the server due to insufficient file path validation in the setSupportCustomImage function. Exploitation requires two steps: saving a malicious path in a configuration field, then triggering deletion by uploading a new image.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthorized file deletions or suspicious activity in the JS Help Desk plugin. Review server logs for file deletion events, especially those involving the support_custom_img parameter. Look for administrators saving unusual values in the support_custom_img configuration field.

Useful 0 Not Useful 0

Impact Analysis

An attacker could delete critical files like wp-config.php, leading to remote code execution. This could compromise the entire WordPress site, allowing unauthorized access, data theft, or site defacement. The attack requires admin privileges but can cause severe damage once exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the JS Help Desk plugin to the latest version beyond 5.0.1. If an update is unavailable, disable the plugin until a patch is released. Remove any unauthorized administrator-level access and audit file permissions. Monitor server logs for signs of exploitation.

Useful 0 Not Useful 0