This vulnerability primarily impacts environments where the web server does not honor .htaccess files or where such directives are disabled, including nginx, LiteSpeed, and Apache configurations with 'AllowOverride None'. Successful exploitation grants the attacker the ability to achieve remote code execution on the underlying server. Defenders should focus on monitoring for unauthorized file uploads in the plugin directory and unexpected requests directed at the admin-post.php endpoint.

Impact

Successful exploitation allows an unauthenticated remote attacker to gain remote code execution capabilities on the host server. This impact is significant for any WordPress installation utilizing the Paid Downloads plugin, as it could lead to full site compromise, exfiltration of sensitive database content, and further lateral movement within the network. The scope includes any server running the vulnerable versions of the plugin on web server software that does not restrict file execution via .htaccess.

Recommendation

Prioritize updating the Paid Downloads plugin to the latest secure version immediately. If an update is not available, temporarily disable the plugin until a patch is applied.

• Monitor web access logs for anomalous POST requests to /wp-admin/admin-post.php.
• Audit the file system for recently uploaded executable files (e.g., .php files) within the plugin upload directories.
• Implement strict file-type and size limitations on web server configurations.
• Utilize the Sigma rule provided below to detect potential exploitation attempts.