Executive brief
The Peugeot Music plugin for WordPress contains a critical security flaw that allows anyone to upload files to the web server without logging in. By uploading a malicious script, an attacker can take complete control of the website and its underlying server. This could lead to the theft of sensitive data, website defacement, or the installation of ransomware.
Technical details
An arbitrary file upload vulnerability exists in the Peugeot Music plugin version 1.0 for WordPress due to a lack of authentication and insufficient file validation in the 'upload.php' endpoint. An unauthenticated remote attacker can send a specially crafted POST request to the vulnerable script, manipulating the 'name' parameter to specify a PHP extension. This allows the attacker to upload a web shell or other malicious code to the '/uploads/' directory. Once uploaded, the attacker can execute the file by accessing it directly via a web browser, leading to remote code execution (RCE) and full system compromise.
Affected products
- WordPress Plugin Peugeot Music Peugeot Music 1.0
Timeline
- 2018-05-23: disclosed: Initial exploit published on Exploit-DB
- 2026-05-17: advisory: CVE record published and NVD entry created