Executive Summary

The vulnerability exists in the WP Delicious – Recipe Plugin for Food Bloggers for WordPress, versions up to and including 1.9.0. It allows an attacker with at least Contributor-level permissions to upload arbitrary files by importing recipes via CSV. Specifically, the attacker can provide a remote URL during the recipe import process to upload a malicious PHP file, which can then lead to Remote Code Execution (RCE) on the affected site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a severe impact as it allows an attacker to execute arbitrary code on your WordPress site remotely. This can lead to full compromise of the website, including data theft, defacement, installation of malware, or using the site as a launchpad for further attacks. Since the attacker only needs Contributor-level permissions, which are commonly granted to trusted users, the risk is significant.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the WP Delicious – Recipe Plugin for Food Bloggers to a version later than 1.9.0 where the arbitrary file upload flaw is fixed. Additionally, restrict Contributor-level users from importing recipes via CSV until the update is applied, and monitor for any suspicious file uploads or remote code execution attempts related to recipe imports.

Useful 0 Not Useful 0