Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running vulnerable versions of the Profile Builder plugin.
2. Attacker crafts a multipart/form-data HTTP POST request targeting /wp-admin/admin-ajax.php.
3. Attacker includes the action parameter set to trigger the 'wppb_ajax_simple_avatar' handler.
4. Attacker embeds a malicious script (e.g., a PHP webshell) within the file upload field of the request.
5. The server-side code fails to validate the extension or MIME type of the uploaded file.
6. The malicious file is stored on the server's filesystem, typically within the WordPress uploads directory or a subdirectory utilized by the plugin.
7. Attacker triggers execution of the uploaded file by navigating to its direct URL path.
8. Attacker gains arbitrary command execution in the context of the web server user.

Impact

Successful exploitation allows for full remote code execution on the underlying web server. This leads to complete compromise of the WordPress site, potential exfiltration of database contents, persistent backdoors, and possible lateral movement into the hosting environment. This vulnerability affects any organization running the vulnerable plugin version on a publicly accessible WordPress instance.

Recommendation

Prioritized actions for defense:

• Upgrade the Profile Builder plugin to version 3.16.2 or later immediately.
• Audit existing files in the WordPress uploads directory for suspicious PHP files if compromise is suspected.
• Implement web application firewall (WAF) rules to inspect and block anomalous POST requests targeting /wp-admin/admin-ajax.php with suspicious file extensions in the payload.
• Deploy the provided Sigma rule to detect attempts to invoke the vulnerable AJAX handler.