WordPress WP Time Capsule Arbitrary File Upload to RCE
Title source: metasploitExploitation Summary
CVE-2024-8856 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including Al Baradi Joy, ubaydev, Jenderal92, including a Metasploit module exploits/multi/http/wp_time_capsule_file_upload_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in the WordPress Backup and Staging plugin (≤ 1.21.16), allowing unauthenticated attackers to upload a PHP shell via the upload.php endpoint, leading to remote code execution.
Description
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Exploits (5)
This exploit demonstrates an arbitrary file upload vulnerability in the WordPress Backup and Staging plugin (≤ 1.21.16), allowing unauthenticated attackers to upload a PHP shell via the upload.php endpoint, leading to remote code execution.
The PoC demonstrates an arbitrary file upload vulnerability in the WP Time Capsule WordPress plugin, allowing unauthenticated attackers to upload and potentially execute malicious PHP files. The exploit leverages insufficient file validation in the plugin's upload endpoint.
This repository contains a Python-based scanner for detecting vulnerable versions of the WordPress WP Time Capsule plugin (CVE-2024-8856). It checks for versions below 1.22.22 by fetching the readme.txt file and uses multithreading for efficiency.
This repository contains a functional PoC for CVE-2024-8856, demonstrating unauthenticated RCE via file upload in the WP Time Capsule WordPress plugin. The scanner and RCE scripts confirm vulnerability by uploading PHP payloads and executing system commands.
This Metasploit module exploits an arbitrary file upload vulnerability in the WordPress WP Time Capsule plugin (versions <= 1.22.21) by bypassing extension validation to upload a malicious PHP file, achieving remote code execution (RCE).
Nuclei Templates (1)
body="/wp-content/plugins/wp-time-capsule/"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H