The WordPress plugin “MailPoet Newsletters” (wysija-newsletters) before 2.6.8 is vulnerable to an unauthenticated file upload. The exploit uses the Upload Theme functionality to upload a zip file containing the payload. The plugin uses the admin_init hook, which is also executed for unauthenticated users when accessing a specific URL. The first fix for this vulnerability appeared in version 2.6.7, but the fix can be bypassed. In PHP’s default configuration, a POST variable overwrites a GET variable in the $_REQUEST array. The plugin uses $_REQUEST to check for access rights. By setting the POST parameter to something not beginning with ‘wysija_’, the check is bypassed. WordPress uses the $_GET array to determine the page, so it is not affected by this. The developers applied the fixes to all previous versions too.
- Marc-Alexandre Montpas
- Christian Mehlmauer <FireFart [at] gmail.com>
- URL: http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html
- URL: http://www.mailpoet.com/security-update-part-2/
- URL: https://plugins.trac.wordpress.org/changeset/943427/wysija-newsletters/trunk/helpers/back.php
- wysija-newsletters < 2.6.8
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’: