Favicon Generator <= 1.5 - Cross-Site Request Forgery zu Löschen von Beliebigen Dateien

The Arbitrary File Access vulnerability in Favicon Generator allows unauthenticated attackers to delete files on the server if they can trick a site administrator into clicking a malicious link. This could lead to complete site compromise, data loss, or denial of service. An attacker could delete core WordPress files, plugin configurations, or even critical system files, effectively taking control of the server. The impact is particularly severe as the plugin's functionality is now discontinued, leaving users with no direct patch option.

WordPress sites using the Favicon Generator plugin, particularly those with administrative users who may be susceptible to social engineering attacks. Shared hosting environments are at increased risk, as a compromised site can potentially impact other users on the same server.

• wordpress / composer / npm:

grep -r "output_sub_admin_page_0" /var/www/html/wp-content/plugins/favicon-generator/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin.php?page=favicon-generator-settings&action=delete_file  # Check for lack of CSRF protection

1. 2024-08-24Disclosure

   disclosure

1. Reserviert2024-08-06
2. Veröffentlicht2024-08-24
3. Geändert2024-08-26
4. EPSS aktualisiert2026-04-02

Since a direct upgrade is not possible due to the plugin being closed, mitigation focuses on preventing exploitation. Implement Web Application Firewall (WAF) rules to block suspicious requests targeting the vulnerable outputsubadminpage0 function. Regularly monitor file system activity for unauthorized deletions. Consider using a security plugin with CSRF protection capabilities. Thoroughly review any WordPress plugins before installation and ensure they are from reputable sources. After implementing WAF rules, verify their effectiveness by simulating a CSRF attack.