Arbitrary File Deletion in Simple Coherent Form WordPress Plugin

Executive Summary

The Simple Coherent Form plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server. This happens because the plugin's removeUploadDir function does not properly validate file paths. Additionally, the scf_get_id_upload endpoint issues a valid file removal nonce to any visitor without authentication, and the secondary hash check used for authorization can be forged offline due to a hardcoded salt in the plugin source. This means attackers can bypass authorization controls and delete important files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because attackers can delete critical files on the server, such as the wp-config.php file. Deleting such files can lead to remote code execution, allowing attackers to take control of the server. Since the vulnerability requires no authentication and has a low attack complexity, it poses a high risk of exploitation, potentially resulting in significant damage to the website and server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution. Such unauthorized access and manipulation of server files can compromise the confidentiality, integrity, and availability of data.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the ability for attackers to delete critical files (e.g., wp-config.php) and execute remote code could lead to breaches of personal or sensitive data, thereby impacting compliance with data protection regulations that require safeguarding data against unauthorized access and ensuring system integrity.

Useful 0 Not Useful 0