BaseFortify

Executive Summary

The WooMulti WordPress plugin up to version 17 does not properly validate a file parameter when deleting files. This flaw allows any authenticated user, including low-privileged users like subscribers, to delete arbitrary files on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow authenticated users to delete any files on the server, potentially leading to data loss, disruption of website functionality, or compromise of server integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to reproduce the exploit scenario. Place a test file (e.g., test.php) in the root WordPress directory, then send a crafted POST request to the admin-ajax.php endpoint with parameters specifying the deletion action and a path traversal sequence targeting the test file. For example, using curl: curl -X POST -d 'action=delete_file&file=.../../../test.php' https://yourwordpresssite.com/wp-admin/admin-ajax.php with an authenticated subscriber cookie. If the test file is deleted, the vulnerability exists. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Since there is currently no known fix for this issue, immediate mitigation steps include restricting subscriber-level user permissions to prevent file deletion actions, monitoring and logging POST requests to admin-ajax.php for suspicious file deletion attempts, and removing or limiting access to the vulnerable WooMulti plugin until a patch is released. [1]

Useful 0 Not Useful 0