Executive brief
The Abtest plugin for WordPress, used for A/B split testing of website content and themes, contains a security flaw that allows unauthorized access to internal files. An attacker can exploit this to view sensitive system files or potentially execute malicious code on the web server. This could lead to a full compromise of the website and the exposure of private customer or configuration data.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the WordPress Abtest plugin (up to version 1.0.6) due to improper sanitization of the 'action' GET parameter in the abtest_admin.php file. The code directly concatenates user input into a PHP 'include' statement without sufficient validation, allowing an unauthenticated attacker to traverse directories and include arbitrary PHP files from the server. While the code appends a '.php' extension, attackers can still target existing files within the application or use PHP wrappers to disclose sensitive information or achieve remote code execution if they can upload or influence other files on the system. The vulnerability is reachable via a direct GET request to the plugin's admin directory.
Affected products
- Lasse Bunk (lassebunk) Abtest <= 1.0.6
Timeline
- 2016-03-19: disclosed: Initial discovery and exploit published by CrashBandicot
- 2024-03-01: other: GitHub repository archived by owner
- 2026-06-15: advisory: CVE published and NVD record created