WordPress Analyse Uploads Plugin <= 0.5 - Arbitrary File Deletion Schwachstelle

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and read any file the web server process has access to. This could include configuration files containing database credentials, private keys, or source code. Successful exploitation could lead to complete compromise of the WordPress installation and potentially the underlying server. The attacker could exfiltrate sensitive data, modify website content, or gain further access to the system.

WordPress websites utilizing the Analyse Uploads plugin, particularly those running older versions (≤0.5), are at risk. Shared hosting environments where multiple websites share the same server resources are especially vulnerable, as a compromise of one site could potentially expose files on other sites.

• wordpress / composer / npm:

grep -r "../" /var/www/html/wp-content/plugins/analyse-uploads/

• generic web:

curl -I http://your-wordpress-site.com/wp-content/uploads/../../../../etc/passwd | head -n 1

1. 2024-10-16Disclosure

   disclosure

1. Reserviert2024-10-14
2. Veröffentlicht2024-10-16
3. EPSS aktualisiert2026-04-02

The primary mitigation is to immediately upgrade the Analyse Uploads plugin to version 0.5.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal sequences (e.g., '../'). Carefully review file upload handling logic within the plugin and implement stricter validation to prevent malicious file paths. Monitor web server access logs for unusual file access attempts.