Executive Summary

The WordPress Plugin Abtest, versions 1.0.6 and below, contains a local file inclusion (LFI) vulnerability in the abtest_admin.php file. This vulnerability occurs because the plugin improperly controls the filenames used in the 'action' parameter of GET requests.

An unauthenticated attacker can manipulate the 'action' parameter to include arbitrary files from the server's admin directory. This can lead to the execution of arbitrary code on the server.

The vulnerability arises from the plugin directly concatenating user input from the 'action' parameter into a file path without proper sanitization, enabling path traversal attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to include and execute arbitrary files on your server without authentication.

• Execution of arbitrary code, potentially leading to full server compromise.
• Exposure of sensitive files on the server, such as configuration files or password files.
• Potential disruption of website functionality or unauthorized access to administrative features.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious GET requests to the abtest_admin.php file that include manipulated 'action' parameters attempting local file inclusion.

• Look for HTTP GET requests with URLs similar to: /wp-content/plugins/abtest/abtest_admin.php?action=[payload]
• Payloads may include path traversal sequences such as ../../../../etc/passwd or other local file paths.

You can use network monitoring tools or web server logs to search for such requests.

• Example command to search Apache logs for suspicious requests: grep 'abtest_admin.php?action=' /var/log/apache2/access.log
• Use curl or wget to test if the vulnerability exists by sending crafted requests, e.g.: curl 'http://yourwordpresssite/wp-content/plugins/abtest/abtest_admin.php?action=../../../../etc/passwd'

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or removing the vulnerable WordPress Abtest plugin, especially versions 1.0.6 and below.

If removal is not immediately possible, restrict access to the abtest_admin.php file to trusted users only, for example by IP whitelisting or authentication.

Monitor web server logs for suspicious requests targeting the 'action' parameter to detect exploitation attempts.

Apply any available patches or updates from the plugin vendor if they become available.

Useful 0 Not Useful 0