Executive brief
WP-Property is a WordPress plugin used for real estate and property management. A security flaw in an included third-party component allows anyone on the internet to upload malicious files to the server without needing a password. This can lead to a complete takeover of the website, allowing attackers to steal data, modify content, or disrupt operations.
Technical details
The WP-Property plugin for WordPress, up to and including version 1.35.0, is vulnerable to an unrestricted file upload in the 'uploadify.php' script located within its third-party directory. The vulnerability stems from a lack of authentication and insufficient file type validation in the upload handler. A remote, unauthenticated attacker can send a specially crafted POST request to upload arbitrary PHP files to a temporary directory on the web server. Once uploaded, the attacker can access these files directly via a web browser to execute arbitrary code with the privileges of the web server user. The plugin was closed on the WordPress repository in 2021 due to security issues.
Affected products
- Andy Potanin WP-Property up to and including 1.35.0
Timeline
- 2012-03-26: disclosed: Initial discovery and disclosure date
- 2012-06-05: other: Exploit code published on Exploit-DB
- 2021-10-06: other: Plugin closed on WordPress.org due to security issues
- 2025-08-05: advisory: CVE-2012-10027 published/updated in NVD
References
- http://web.archive.org/web/20150103065650/http://www.opensyscom.fr:80/Actualites/wordpress-plugins-wp-property-shell-upload-vulnerability.html
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/wp_property_upload_exec.rb
- https://wordpress.org/plugins/wp-property/
- https://www.exploit-db.com/exploits/18987
- https://www.exploit-db.com/exploits/23651
- https://www.vulncheck.com/advisories/wordpress-plugin-wp-property-php-file-upload