Executive brief
Gpx2Graphics is a WordPress plugin that processes geographic data files. The plugin fails to verify user requests (CSRF protection) and does not validate uploaded file types, allowing attackers to trick administrators into uploading malicious PHP files. Successful exploitation results in remote code execution on the web server.
Technical details
The vulnerability is an arbitrary file upload combined with CSRF. The plugin's file upload handler lacks CSRF token validation and does not enforce file type restrictions, allowing an unauthenticated attacker to craft a malicious request that, when visited by a logged-in administrator, uploads arbitrary files (including PHP scripts) to the server. The attack requires administrator-level user interaction (clicking a link or visiting a malicious page while logged in). Successful exploitation grants the attacker the ability to execute arbitrary PHP code in the web server context, typically leading to full site compromise or lateral movement within the hosting environment.
Affected products
- Gpx2Graphics Gpx2Graphics through 0.3
Timeline
- 2026-09-10: disclosed
- 2026-09-12: advisory