#VU27299 Arbitrary file upload in MapPress Maps for WordPress - CVE-2020-12077

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the affected plugin registers several AJAX actions that calls functions without capability checks or nonce checks. A remote authenticated attacker can send a specially crafted "$_POST" request to "wp-admin/admin-ajax.php" and upload and execute arbitrary file on the server.

Successful exploitation of this vulnerability allows a remote attacker to cause arbitrary File Upload, Deletion, and Disclosure Leading to RCE or Site Reset.

This vulnerability affects the following AJAX hooks:

add_action('wp_ajax_mapp_tpl_get', array(__CLASS__, 'ajax_get')); 

add_action('wp_ajax_mapp_tpl_save', array(__CLASS__, 'ajax_save')); 

add_action('wp_ajax_mapp_tpl_delete', array(__CLASS__, 'ajax_delete'));

Remediation

External links

• https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-patched-in-mappress-maps-plugin/