Attack Chain

1. The attacker authenticates to the WordPress application with low-level privileges.
2. The attacker crafts a malicious POST request targeting the admin-ajax.php endpoint.
3. The POST request includes parameters action set to the vulnerable plugin’s AJAX action hook, and file_name and folder_name parameters specifying the target file for deletion.
4. The WordPress server processes the request without proper validation of the file_name and folder_name parameters.
5. The plugin’s code constructs a file path using the provided parameters.
6. The plugin’s code calls the PHP unlink() function with the constructed file path, attempting to delete the specified file.
7. If the attacker-controlled path is accessible to the WordPress process, the file is deleted from the server.
8. The attacker repeats this process to delete multiple files, causing data loss or potentially disrupting the website functionality.

Impact

Successful exploitation of CVE-2021-47979 allows an attacker to delete arbitrary files within the WordPress installation directory. This can lead to significant data loss, including critical website files, database backups, and uploaded media. The impact can range from defacement to complete website unavailability, potentially affecting businesses relying on the WordPress platform.

Recommendation

• Upgrade the WordPress Backup and Restore plugin to a version that patches CVE-2021-47979 if a patch is available.
• Deploy the Sigma rule “Detect CVE-2021-47979 Exploitation Attempt via WordPress admin-ajax.php” to detect malicious POST requests to admin-ajax.php with suspicious file_name and folder_name parameters.
• Implement strict file access controls on the WordPress server to limit the files that the WordPress process can access and delete.