Make WordPress Core

Opened 13 years ago

Closed 13 years ago

Last modified 13 years ago

#17969 closed defect (bug) (invalid)

Code Execution vulnerability in WordPress

Reported by: macbroadcast's profile macbroadcast Owned by:
Milestone: Priority: normal
Severity: normal Version: 3.2
Component: General Keywords: needs-patch
Focuses: Cc:


An attacker was able to upload a “directory”within the wordpress directory and i found out that the “contact form”module might cause the problem because i allways found a “wpcf7_captcha”directory in my upload folder ,so i removed the module ,set new passwords for worpress and all went fine for a day.

Today i received another mail from that the same script is still on my site just in a “theme”folder.

It seems the attacker found a vulnerabilty in wordpress so i removed the used theme and directory.

SecurityVulns ID:11622.

Affected products:

Vulnerable are versions WordPress 2.5 –3.1.1. The new version 3.1.2 which released at 26th of April just after my disclosure also must be vulnerable. The attack via double extension will work at Apache with appropriate configuration.

———- Details:———-

Code Execution (WASC-31) attack is possible in WordPress via uploader. The attack can be conducted by users with roles Author,Editor and Administrator. In WordPress 2.5 –2.8.4 it’s possible to upload php scripts (1.php) in Media Library. In 2.5 –2.7.1 the attack is possible only for Administrator. For Author and Editor it’s not possible to upload 1.php,nor attack will work via double extensions. In version 2.8.5 it was prohibited also for Administrator. And even in 2.8 –2.8.5 for Author and Editor (and for Administrator in 2.8.5) it’s impossible to upload 1.php,but it’s possible to upload 1.php.txt. At that in WP 2.0 –2.0.11 (where there were no Media Library) for all roles were prohibited to upload files with php extension (and bypassing method didn’t work). As in versions 2.1.x,2.2.x and 2.3.x. Only in WordPress 2.2 ( Alexander Concha found vulnerability,which allowed to upload files with php extension. In version 2.8.6 and higher it’s already prohibited. The attack via double extensions (1.php.txt and 1.asp;.txt) will not work,but it’s possible to use 1.phtml.txt (for all three roles) to execute code.


2011.04.26 –disclosed at my site. As I already wrote many times to security mailing lists (,starting from 2008 I never more inform WP developers about vulnerabilities in WordPress. I mentioned about these vulnerabilities at my site ( Best wishes ®ards,MustLive Administrator of Websecurity web site

more at

Attachments (1) (12.7 KB) - added by macbroadcast 13 years ago.
this is the philising script whitch were uploadet to my wp instaltion

Download all attachments as: .zip

Change History (7)

13 years ago

this is the philising script whitch were uploadet to my wp instaltion

#1 @ocean90
13 years ago

From the big red box:

Do not report potential security vulnerabilities here. Read the Security FAQ and email us at security@….

Last edited 13 years ago by ocean90 (previous) (diff)

#2 follow-up: @macbroadcast
13 years ago

i wrote to the email adress you mentioned and i am waiting for a response.


Last edited 13 years ago by macbroadcast (previous) (diff)

#3 in reply to: ↑ 2 @nacin
13 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to invalid
  • Severity changed from critical to normal
  • Status changed from new to closed

Replying to macbroadcast:

i wrote to the email adress you mentioned and i am waiting for a response.

Next time do that first. Two years ago.

This ticket is invalid as of 3.1.3.

#4 @macbroadcast
13 years ago

I did this first,( July 3, 2011 2:45:52 PM GMT+02:00)but they simple dont respond and whatever is invalid or not, ive got attacked several times since friday and i am using the latest wordpress version 3.1.4. i changed my worpress password and its still possible to compromise the system.So tell me whats invalid now

#5 @nacin
13 years ago

You emailed us 2.5 hours ago on a Sunday morning.

You also emailed a mailing list *before* you emailed security@…, and then didn't wait for a reply before posting here.

I don't think you being hacked has anything to do with an ongoing attack vector. You're welcome to email access logs to security@… to back up your claim.

In the meantime, I want to emphasize yet another reason why we encourage responsible disclosure versus full disclosure -- the reporter isn't always right.

#6 @xknown
13 years ago

It would be good to fix the security FAQ link when creating a new ticket (see #17479) :)

macbroadcast, the attack vector you mention can only be used with in a multi user environment, which does not seem to be the case for your site.

Note: See TracTickets for help on using tickets.