CVE-2018-14028 — HIGH (7.2)

Vulnerability Description

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins.

CVSS Score

7.2

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Wordpress	Wordpress	4.9.7

Related Weaknesses (CWE)

CWE-434

References

http://www.securityfocus.com/bid/105060Third Party AdvisoryVDB Entry
https://core.trac.wordpress.org/ticket/44710Third Party Advisory
https://github.com/rastating/wordpress-exploit-framework/pull/52Third Party Advisory
https://rastating.github.io/unrestricted-file-upload-via-plugin-uploader-in-wordThird Party Advisory
http://www.securityfocus.com/bid/105060Third Party AdvisoryVDB Entry
https://core.trac.wordpress.org/ticket/44710Third Party Advisory
https://github.com/rastating/wordpress-exploit-framework/pull/52Third Party Advisory
https://rastating.github.io/unrestricted-file-upload-via-plugin-uploader-in-wordThird Party Advisory

FAQ

What is CVE-2018-14028?

CVE-2018-14028 is a vulnerability with a CVSS score of 7.2 (HIGH). In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the...

How severe is CVE-2018-14028?

CVE-2018-14028 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-14028?

Check the references section above for vendor advisories and patch information. Affected products include: Wordpress Wordpress.