Description

The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-12T06:16:25.620Z",
  "pubdate": "2026-09-12T06:16:25.620Z",
  "executiveSummary": "The Gpx2Graphics WordPress plugin (up to version 0.3) contains a critical security vulnerability involving the lack of Cross-Site Request Forgery (CSRF) protection and insufficient file type validation during the upload process.\nThis vulnerability is classified as an Arbitrary File Upload flaw, which can be leveraged to achieve Remote Code Execution (RCE) on the underlying server.\nThe attack vector requires the target, typically a logged-in administrator, to be lured into visiting a malicious site or clicking a crafted link while authenticated to the WordPress dashboard.\nSuccessful exploitation enables an unauthenticated remote attacker to execute arbitrary PHP code within the context of the web server user.\nThe risk to the confidentiality, integrity, and availability of the entire WordPress installation is extreme, as the attacker gains full control over the application environment and potentially the host server.",
  "technicalDetails": "The Gpx2Graphics plugin, up to version 0.3, exhibits a dual-layered security failure in its file processing logic. The primary root cause is the absence of anti-CSRF tokens (nonces) within the upload request handlers, combined with a total lack of server-side MIME type or file extension validation.\nThe exploitation flow begins when an attacker crafts a malicious web page containing a hidden form or an asynchronous request designed to trigger the plugin's file upload functionality. When an authenticated administrator accesses this page, the browser automatically attaches the administrator's session cookies to the forged request, bypassing authentication mechanisms.\nBecause the plugin does not verify the origin of the request nor implement strict validation on the 'file' parameter, the attacker can force the server to write an arbitrary PHP file into a publicly accessible directory. The plugin fails to sanitize the input or check against a whitelist of permitted file extensions, allowing the injection of executable server-side scripts.\nPost-upload, the attacker simply navigates to the URL where the malicious script was stored. Upon invocation, the PHP interpreter processes the uploaded code, granting the attacker arbitrary command execution capabilities. This level of access typically results in full application compromise, including database extraction, defacement, or the installation of persistent backdoors such as web shells.\nThe vulnerability is exposed via the web interface and requires no specialized privileges from the attacker's perspective, provided the administrator is tricked into performing the action. Because the server-side code performs no checks on the content or nature of the uploaded file, the system becomes a vehicle for malicious payload delivery directly into the application's file space, facilitating complete Remote Code Execution."
}