QID 154154

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.

Its possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation, the uploaded file remains temporarily available in the Media Library despite it not being allowed.

If the DISALLOW_FILE_EDIT constant is set to true on the site and FTP credentials are required when uploading a new theme or plugin, then this technically allows an RCE (Remote Code Execution) when the user would otherwise have no means of executing arbitrary PHP code. This issue only affects Administrator-level users on single-site installations and Super Admin-level users on Multisite installations, where it's otherwise expected that the user does not have permission to upload or execute arbitrary PHP code.

Affected Versions:
WordPress below 4.1.39
WordPress from 4.2 to 4.2.36
WordPress from 4.3 to 4.3.32
WordPress from 4.4 to 4.4.31
WordPress from 4.5 to 4.5.30
WordPress from 4.6 to 4.6.27
WordPress from 4.7 to 4.7.27
WordPress from 4.8 to 4.8.23
WordPress from 4.9 to 4.9.24
WordPress from 5.0 to 5.0.20
WordPress from 5.1 to 5.1.17
WordPress from 5.2 to 5.2.19
WordPress from 5.3 to 5.3.16
WordPress from 5.4 to 5.4.14
WordPress from 5.5 to 5.5.13
WordPress from 5.6 to 5.6.12
WordPress from 5.7 to 5.7.10
WordPress from 5.8 to 5.8.8
WordPress from 5.9 to 5.9.8
WordPress from 6.0 to 6.0.6
WordPress from 6.1 to 6.1.4
WordPress from 6.2 to 6.2.3
WordPress from 6.3 to 6.3.2
WordPress from 6.4 to 6.4.2

QID Detection Logic:
This QID sends an HTTP GET request and checks for vulnerable version of WordPress running on the target application.

Successful exploitation of this vulnerability could allow an administrator level users on single site installations and Super Admin level users on Multisite installations execute arbitrary PHP code.