CVE-2017-16949

CRITICAL

AccessKeys AccessPress Anonymous Post Pro <3.1.9 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-16949. PoCs published by Colette Chamberland.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated arbitrary file upload vulnerability in AccessPress Anonymous Post Pro < 3.2.0. The attacker can override allowed file extensions and upload a PHP shell by manipulating the `allowedExtensions` and `sizeLimit` parameters in a POST request.

Description

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution.

Exploits (1)

exploitdb WORKING POC
by Colette Chamberland · textwebappsphp
https://www.exploit-db.com/exploits/43324

This exploit demonstrates an unauthenticated arbitrary file upload vulnerability in AccessPress Anonymous Post Pro < 3.2.0. The attacker can override allowed file extensions and upload a PHP shell by manipulating the `allowedExtensions` and `sizeLimit` parameters in a POST request.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: AccessPress Anonymous Post Pro < 3.2.0
No auth needed
Prerequisites: Target running vulnerable version of AccessPress Anonymous Post Pro · Access to the WordPress admin-ajax.php endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/43324/
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://wpvulndb.com/vulnerabilities/8977

Scores

CVSS v3 9.8
EPSS 0.1915
EPSS Percentile 97.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
accesspressthemes/anonymous_post_pro < 3.1.9
Published Dec 19, 2017
Tracked Since Feb 18, 2026