Unrestricted File Upload in Cozmoslabs Profile Builder Plugin

The Cozmoslabs Profile Builder plugin for WordPress, in versions up to and including 3.16.1, contains an unrestricted file upload vulnerability. This flaw resides in the 'wppb_ajax_simple_avatar' function within the 'admin-ajax.php' component, which handles simple avatar uploads. Because the handler fails to properly validate the type or content of uploaded files, a remote, unauthenticated attacker can upload arbitrary files to the web server. If the target server is configured to execute files within the upload directory, this vulnerability can be leveraged to achieve remote code execution (RCE). The vulnerability has been publicly disclosed with functional exploit code available. Administrators are advised to update the Profile Builder plugin to version 3.16.2 or later to remediate this issue.

Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running vulnerable versions of the Profile Builder plugin.
2. Attacker crafts a multipart/form-data HTTP POST request targeting /wp-admin/admin-ajax.php.
3. Attacker includes the action parameter set to trigger the 'wppb_ajax_simple_avatar' handler.
4. Attacker embeds a malicious script (e.g., a PHP webshell) within the file upload field of the request.
5. The server-side code fails to validate the extension or MIME type of the uploaded file.
6. The malicious file is stored on the server's filesystem, typically within the WordPress uploads directory or a subdirectory utilized by the plugin.
7. Attacker triggers execution of the uploaded file by navigating to its direct URL path.
8. Attacker gains arbitrary command execution in the context of the web server user.

Impact

Successful exploitation allows for full remote code execution on the underlying web server. This leads to complete compromise of the WordPress site, potential exfiltration of database contents, persistent backdoors, and possible lateral movement into the hosting environment. This vulnerability affects any organization running the vulnerable plugin version on a publicly accessible WordPress instance.

Recommendation

Prioritized actions for defense:

• Upgrade the Profile Builder plugin to version 3.16.2 or later immediately.
• Audit existing files in the WordPress uploads directory for suspicious PHP files if compromise is suspected.
• Implement web application firewall (WAF) rules to inspect and block anomalous POST requests targeting /wp-admin/admin-ajax.php with suspicious file extensions in the payload.
• Deploy the provided Sigma rule to detect attempts to invoke the vulnerable AJAX handler.