WordPress Simple File List Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Simple File List WordPress plugin, affecting versions prior to 4.2.3. The issue arises from an unauthenticated arbitrary file upload feature, which allows attackers to upload PHP files disguised as PNG images. Once uploaded, these files can be renamed to use a .php extension and executed on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, with the executed code running in the context of the web server user.

Reproduction

To reproduce this vulnerability, upload a file containing PHP code through the WordPress Simple File List plugin's file upload feature, using a .png extension. After the file is uploaded, send a request to rename the file to use a .php extension. Once renamed, the PHP code can be executed by accessing the file via the web server.

Remediation

Users are advised to update the Simple File List WordPress plugin to version 4.2.3 or later.