CVE-2023-29386

CRITICAL

WordPress Manager for Icomoon plugin <= 2.0 - Arbitrary File Upload vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-29386 has a selected CVSS score of 9.1 (critical); EIP currently links 1 repository PoC and 1 lab environment.

Description

Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 2, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Manager for Icomoon

Browse Julien Crego / Manager for Icomoon

Default status: unaffected

CVE ListThrough 2.0affected

manager_for_icomoon

Browse juliencrego / manager_for_icomoon

Default status: unaffected

CVE ListBefore 2.0affected

Proofs of concept

1

Repository PoCs

GitHubvigilante-1337/CVE-2023-29386Repository PoCby vigilante-13370Not analyzed6 files

857.7 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

safe-lab/docker_compose.yaml

vigilante-1337/CVE-2023-29386Created Vuln labCVE-2023-29386Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a WordPress service with MariaDB, intended as a controlled lab for reproducing CVE-2023-29386.

safe-lab/docker_compose.yaml:1-42readme.md:1-108

Lab assessment

Vulnerability lab

The README explicitly states the environment is for reproducing CVE-2023-29386, a WordPress arbitrary file upload vulnerability, and provides instructions for deploying the lab and installing vulnerable plugins.

readme.md:1-3readme.md:47-60
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mariadb

database

MariaDB service providing the WordPress database, configured with root and user credentials.

safe-lab/docker_compose.yaml:4-14

exploitdev

web servervulnerable target

WordPress service with PHP 8.4 and Apache, exposed on port 80, intended to host the vulnerable Manager for Icomoon plugin.

safe-lab/docker_compose.yaml:16-32
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-29386

Supported by supplied evidence

The README describes the vulnerability as an unauthenticated arbitrary file upload in Manager for Icomoon < 2.1, and the lab includes a vulnerable plugin ZIP file for testing.

readme.md:1-3readme.md:47-60
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to deploy the lab.readme.md:47-50
  • After deployment, an administrator must log in to WordPress and manually upload and activate the vulnerable plugin from safe-lab/manager-for-icomoon.2.0.zip.readme.md:52-60

Evidence-described exercise path

  1. Clone the repository and navigate to the safe-lab directory.readme.md:47-50
  2. Start the lab with 'sudo docker compose up -d'.readme.md:50
  3. Complete WordPress setup and log in as administrator.readme.md:52-54
  4. Upload and activate the vulnerable plugin from safe-lab/manager-for-icomoon.2.0.zip.readme.md:55-57
  5. Exploit the unauthenticated arbitrary file upload vulnerability to achieve remote code execution.readme.md:1-3readme.md:11-13
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Compose file defines a standard WordPress and MariaDB setup with no privileged mode, no host volume mounts beyond named Docker volumes, and no suspicious commands. The README explicitly warns to use the lab only in isolated environments. All behavior is directed at the contained lab target.

safe-lab/docker_compose.yaml:1-42readme.md:47-60
Review boundaries

What the analysis did not establish

  • The vulnerable plugin ZIP file (safe-lab/manager-for-icomoon.2.0.zip) is a binary and was not inspected.
  • The exploit binary referenced in the README is not included in the evidence packet and was not analyzed.
  • The packet does not include the actual exploit code or proof-of-concept, only the lab infrastructure.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2