A Remote File Inclusion vulnerability exists in the Advanced Custom Fields plugin for WordPress. Unsafe usage of PHP’s array_merge function allows attackers to overwrite data to potentially achieve remote code execution.
- Attacker sends a specially crafted request to ‘advanced-custom-fields/core/actions/export.php’, populating the ‘acf_abspath’ parameter with an attacker-controlled host.
- The ‘acf_abspath’ parameter is passed to a require_once call, resulting in file inclusion from the specified host.
You will need the WordPress plugin Advanced Custom Fields with a version before 3.5.2.
A Remote File Inclusion vulnerability exists in the Advanced Custom Fields plugin for WordPress. The vulnerability lies in script /core/actions/export.php. This script contains unsafe usage of PHP’s array_merge, allowing attackers to overwrite an included variable via specially crafted requests. This can result in remote code execution. No authentication is required for successful execution of this attack.
Alert Logic Coverage
Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.
The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.
Recommendations for Mitigation
- Disable or restrict access to the plugin until a patch can be applied.
- Upgrade the plugin to the most recent patched version.