Vulnerabilities

Remote Code Execution Flaws Patched in WordPress Download Manager Plugin

A vulnerability patched recently in the WordPress Download Manager plugin could be abused to execute arbitrary code under specific configurations, the Wordfence team at WordPress security company Defiant warns.

Ionut Arghire

July 30, 2021

Tracked as CVE-2021-34639 and having a CVSS score of 7.5, the bug is an authenticated file upload issue that could have allowed attackers to upload files with php4 extensions, as well as files that could be executed if certain conditions were met.

Specifically, the plugin was found vulnerable to a double extension attack, where a file with multiple extensions could be used to execute code.

“For instance, it was possible to upload a file titled info.php.png. This file would be executable on certain Apache/mod_php configurations that use an AddHandler or AddType directive,” Wordfence explains.

The security researchers point out that, although this is a high-severity issue, its exploitation is not as simple, because an .htaccess file in the download directory prevents the execution of uploaded files.

WordPress Download Manager releases prior to version 3.1.24 are impacted. The vulnerability was patched in early May alongside a medium-severity flaw that could be abused to access sensitive information.

Tracked as CVE-2021-34638 (CVSS score of 6.5), the issue is a directory traversal that could allow a low privileged user “to retrieve the contents of a site’s wp-config.php file by adding a new download and performing a directory traversal attack using the file[page_template] parameter,” Wordfence says.

Thus, the contents of the wp-config.php file are displayed in the page source when previewing the download.

The vulnerability, Wordfence explains, could also be abused for code execution. A user with the permissions of an author could upload a file with an image extension but which includes malicious JavaScript.

By including the path of the uploaded file in the file[page_template] parameter, the user would ensure that the JavaScript could be executed whenever the page was viewed or previewed. This would lead to stored cross-site scripting, allowing the attacker to take over a site by executing code in the administrator’s browser session.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar