Executive Summary

This vulnerability exists in the Extensive VC Addons for WPBakery page builder plugin for WordPress, affecting all versions up to and including 1.9.1. It is a Local File Inclusion (LFI) vulnerability caused by insufficient path normalization and validation of the user-supplied 'shortcode_name' parameter in the 'extensive_vc_init_shortcode_pagination' AJAX action. This flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server by manipulating the 'shortcode_name' parameter, leading to execution of any PHP code contained in those files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts as it allows unauthenticated attackers to execute arbitrary PHP code on the affected server. This can lead to full compromise of the server, including unauthorized access, data theft, data modification, service disruption, or further attacks within the network. The high CVSS score (8.1) reflects the critical nature of this vulnerability with high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious AJAX requests to the WordPress site targeting the `extensive_vc_init_shortcode_pagination` action with unusual or malicious `shortcode_name` parameter values that attempt Local File Inclusion. You can check your web server logs or use tools like curl to simulate such requests. For example, a command to test might be: curl -X POST -d "action=extensive_vc_init_shortcode_pagination&shortcode_name=../../../../etc/passwd" https://yourwordpresssite.com/wp-admin/admin-ajax.php Additionally, scanning for the presence of the Extensive VC Addons for WPBakery plugin version 1.9.1 or earlier can help identify vulnerable installations. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1. Update the Extensive VC Addons for WPBakery page builder plugin to a version later than 1.9.1 where this vulnerability is fixed. 2. If an update is not immediately possible, restrict access to the AJAX endpoint `admin-ajax.php` for unauthenticated users or implement a Web Application Firewall (WAF) rule to block requests with suspicious `shortcode_name` parameters. 3. Monitor logs for exploitation attempts and consider disabling the plugin temporarily if exploitation is detected. 4. Apply principle of least privilege to the WordPress installation and server to limit damage from potential exploitation.

Useful 0 Not Useful 0