Executive brief
The Baggage Freight Shipping Australia plugin for WordPress, which provides shipping rate calculations for Australian e-commerce stores, contains a critical security flaw. An unauthenticated attacker can upload malicious files directly to the web server, potentially leading to a complete takeover of the website. This could result in the theft of customer data, site defacement, or the use of the server for further attacks.
Technical details
An unrestricted file upload vulnerability exists in the 'upload-package.php' endpoint of the Baggage Freight Shipping Australia plugin (v0.1.0). The root cause is a lack of validation in the file upload handler, which uses the move_uploaded_file() function on user-supplied files without checking extensions or content types. An unauthenticated remote attacker can send a specially crafted POST request containing a PHP script. The server saves the file to the '/wp-content/plugins/baggage_shipping/upload/' directory with a predictable timestamp-based filename, allowing the attacker to execute arbitrary code and gain full control over the WordPress environment.
Affected products
- Shipster Baggage Freight Shipping Australia 0.1.0
Timeline
- 2018-12-24: disclosed: Vulnerability discovered by researcher Kaimi
- 2018-12-27: other: Exploit published on Exploit-DB
- 2026-06-15: advisory: CVE-2018-25436 published/updated in NVD