Subscriber Arbitrary File Upload in Taskbot

Executive Summary

This vulnerability is an Arbitrary File Upload flaw in the WordPress Taskbot Plugin versions 6.6 and below. It allows attackers with Subscriber-level access to upload malicious files to the server, potentially leading to full server compromise.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file uploads in the Taskbot plugin directory. Look for unexpected files with extensions like .php, .exe, or .js in the uploads folder. Review server logs for POST requests to /wp-content/plugins/taskbot/ or similar paths.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to upload malicious files, take over your WordPress site, or use it as a foothold for further attacks. The high CVSS score of 9.9 indicates severe risk of exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the Taskbot plugin immediately if not essential. Apply Patchstack's mitigation rule if available. Restrict Subscriber-level access to only trusted users. Monitor server files for suspicious uploads and consider using a web application firewall.

Useful 0 Not Useful 0