Executive brief
The HS Brand Logo Slider plugin for WordPress, used to display brand logos on websites, contains a security flaw that allows registered users to upload malicious files. By bypassing simple security checks, an attacker can upload and run custom code on the web server. This could lead to a complete takeover of the website, theft of sensitive data, or a total service outage.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in the HS Brand Logo Slider plugin (version 2.1 and below) for WordPress. The vulnerability stems from the 'logoupload' parameter in the admin interface, which relies solely on client-side validation for file extensions. An authenticated attacker can intercept the upload request using a proxy tool, rename a file to have a .php extension, and upload it to the server. Once uploaded, the attacker can access the file directly to execute arbitrary PHP code, leading to full remote code execution (RCE). The plugin has been closed and removed from the WordPress directory due to this security issue.
Affected products
- Helios Solutions HS Brand Logo Slider 2.1 and earlier
Timeline
- 2020-10-20: disclosed: Exploit published on Exploit-DB
- 2020-10-21: other: Plugin closed on WordPress.org due to security issues
- 2026-05-16: advisory: CVE published/updated in NVD