Overview
A serious security vulnerability, designated as CVE-2023-4536, has been identified in the My Account Page Editor WordPress plugin. This flaw, which has a CVSS severity score of 8.8, pertains to the plugin’s failure to validate the profile picture that is uploaded. This vulnerability could be exploited by any authenticated user, including subscribers, to upload arbitrary files which could potentially lead to Remote Code Execution (RCE). This vulnerability has a major impact on the security of WordPress websites using this plugin, as it opens the door for potential system compromise and data leakage.
Vulnerability Summary
CVE ID: CVE-2023-4536
Severity: Critical (CVSS: 8.8)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
No phone number, email, or personal info required.
Product | Affected Versions
My Account Page Editor WordPress Plugin | Versions before 1.3.2
How the Exploit Works
A successful exploitation of this flaw occurs when an authenticated user, such as a subscriber, uploads an arbitrary file disguised as a profile picture. The plugin does not validate the uploaded profile picture, which allows the malicious file to be uploaded to the server. Once the malicious file is on the server, the attacker can execute this file remotely, leading to Remote Code Execution (RCE). This could result in unauthorized system access, manipulation of data, or even a system takeover.
Conceptual Example Code
An example of how this vulnerability might be exploited is shown below. This is a conceptual HTTP request that uploads a malicious file disguised as a profile picture.
POST /upload_profile_picture HTTP/1.1
Host: vulnerable-wordpress-site.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="profile_picture"; filename="malicious_file.jpg"
Content-Type: image/jpeg
{ "malicious_payload": "..." }
------WebKitFormBoundary7MA4YWxkTrZu0gW--In this example, the “malicious_file.jpg” is not a legitimate image file but a malicious file designed to exploit the vulnerability in the My Account Page Editor WordPress Plugin. Once uploaded, the attacker can execute the malicious file remotely, leading to potential system compromise or data leakage.