WP Mobile Detector Plugin for WordPress File Upload RCE

high Nessus Plugin ID 92360

Language:

Synopsis

The remote web server hosts a PHP script that is affected by a remote code execution vulnerability.

Description

The WP Mobile Detector Plugin for WordPress running on the remote web server is affected by a remote code execution vulnerability due to a failure to properly sanitize user-supplied files that are uploaded to the 'resize.php' or 'timthumb.php' scripts under the '/wp-content/plugins/wp-mobile-detector/' directory. An unauthenticated, remote attacker can exploit this issue to execute arbitrary code under the privileges of the web server user.

Solution

Upgrade the Mobile Detector Plugin for Wordpress to version 3.6 or later.

Plugin Details

Severity: High

ID: 92360

File Name: wordpress_wp_mobile_detector_arbitrary_upload.nasl

Version: 1.5

Type: remote

Family: CGI abuses

Published: 7/19/2016

Updated: 8/8/2018

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Required KB Items: installed_sw/WordPress, www/PHP

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 6/2/2016

Vulnerability Publication Date: 5/31/2016

Detections

Analytics