WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability

The impact of this vulnerability is severe. Successful exploitation allows an attacker to upload a web shell, effectively gaining remote code execution (RCE) capabilities on the affected server. This can lead to complete compromise of the web server, including data exfiltration, modification, or deletion. The attacker could also leverage the compromised server to launch further attacks against other systems within the network, expanding the blast radius significantly. The ability to upload arbitrary code bypasses standard security controls and represents a critical risk.

WordPress websites utilizing the iSpring Embedder plugin are at direct risk. Shared hosting environments are particularly vulnerable, as attackers could potentially exploit the vulnerability on multiple websites hosted on the same server. Sites using older, unpatched versions of WordPress or those with weak security configurations are also at increased risk.

• wordpress / composer / npm:

grep -r 'ispring_embedder' /var/www/html/
wp plugin list | grep iSpring Embedder

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/ispring-embedder/ | grep -i 'server'

1. 2025-01-16Disclosure

   disclosure

1. Reserviert2025-01-16
2. Veröffentlicht2025-01-16
3. Geändert2026-04-28
4. EPSS aktualisiert2026-04-02

The primary mitigation is to immediately upgrade iSpring Embedder to version 1.0.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as strict input validation on file uploads and enabling CSRF protection mechanisms within the WordPress environment. Web Application Firewalls (WAFs) configured to detect and block suspicious file upload attempts can also provide a layer of defense. Monitor web server logs for unusual file uploads or execution attempts. After upgrading, confirm the fix by attempting a CSRF attack and verifying that the upload is blocked.