Report on a hacker probing for the presence of a vulnerable WordPress plugin that handles clipboard data

[Disco Bob]

In the last several days someone started making requests using Tor nodes for the file /wp-content/plugins/image-clipboard/readme.txt, which is a file from the WordPress plugin Clipboard Images. That would likely be a hacker probing for usage of the plugin, which has 800+ active installations according to wordpress.org, before exploiting a vulnerability in it. After we noticed that activity this morning we went to look over the code to see if we could find a vulnerability that hackers would be likely to exploit in it and it took only moments to find what in all likelihood is already being exploited.

Making that relatively easy to do is the plugin only contains a single function that contains any code of a substantial nature. That function is named save_image() and it is accessible through WordPress AJAX functionality to those logged in as well as those not logged in to WordPress:

 

The code in that function saves a file to the website’s filesystem using data from the POST input “img”:

 

The saved file can have any extension, but it is give a random name. That random name is returned when a request to the function is made:

 

So a hacker could upload a .php file with malicious code in it and then request the file to have that code execute.

Due to the moderators of the WordPress Support Forum’s continued inappropriate behavior we are full disclosing vulnerabilities in protest until WordPress gets that situation cleaned up, so we are releasing this post and then only trying to notify the developer through the WordPress Support Forum. You can notify the developer of this issue on the forum as well. Hopefully the moderators will finally see the light and clean up their act soon, so these full disclosures will no longer be needed (we hope they end soon). You would think they would have already done that since a previously full disclosed vulnerability was quickly on hackers’ radar, but it appears those moderators have such disdain for the rest of the WordPress community that their continued ability to act inappropriate is more important that what is best for the rest of the community.

 

 

https://www.pluginvulnerabilities.com/2019/01/04/a-hacker-is-probably-already-exploiting-this-arbitrary-file-upload-vulnerability-in-a-wordpress-plugin/