Attack Chain

1. Attacker identifies a target running a vulnerable version of the Computer Repair Shop plugin.
2. Attacker sends an unauthenticated POST request to the admin-ajax.php endpoint.
3. The request exploits the vulnerability to bypass file type validation.
4. A malicious PHP payload is uploaded to the web server directory.
5. The server response provides the direct URL to the newly uploaded file.
6. Attacker accesses the PHP file via a browser to execute code and obtain an interactive shell.

Impact

Successful exploitation allows for unauthenticated remote code execution with the privileges of the web server process. This results in complete compromise of confidentiality, integrity, and availability (CVSS 10.0).

Recommendation

• Update Webfulcreations Computer Repair Shop to a version beyond 3.8115 immediately.
• Implement monitoring for unexpected file creation within the WordPress wp-content/uploads directory or other web-accessible paths.
• Inspect web server access logs for anomalous POST requests directed at admin-ajax.php containing file upload parameters.
• If patching is not immediately feasible, restrict access to admin-ajax.php for unauthorized users via firewall or web application firewall (WAF) rules.