CVE-2015-9272
📋 TL;DR
This vulnerability allows remote attackers to upload and execute arbitrary PHP code on WordPress sites using the vulnerable VideoWhisper Video Presentation plugin. Attackers can bypass file upload restrictions by naming malicious files with '.phtml' extension, leading to remote code execution. All WordPress installations with version 3.31.17 or earlier of this plugin are affected.
💻 Affected Systems
- VideoWhisper Video Presentation plugin for WordPress
📦 What is this software?
Video Presentation by Videowhisper
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, steal data, install backdoors, deface websites, or pivot to internal networks.
Likely Case
Website defacement, data theft, malware distribution, or cryptocurrency mining through uploaded malicious scripts.
If Mitigated
Limited impact with proper file upload restrictions, web application firewalls, and restricted PHP execution in upload directories.
🎯 Exploit Status
Exploitation is straightforward - attackers simply need to upload a .phtml file containing PHP code. Multiple public advisories and proof-of-concepts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.31.18 or later
Vendor Advisory: http://www.vapidlabs.com/advisory.php?v=117
Restart Required: No
Instructions:
1. Update VideoWhisper Video Presentation plugin to version 3.31.18 or later via WordPress admin panel. 2. Alternatively, remove the plugin entirely if not needed. 3. Clear any cached files after update.
🔧 Temporary Workarounds
Block .phtml file uploads via .htaccess
linuxPrevent execution of .phtml files in upload directories
Add to .htaccess in upload directory: <FilesMatch "\\.phtml$">
Order Allow,Deny
Deny from all
</FilesMatch>
Disable PHP execution in upload directories
linuxPrevent any PHP code execution in vulnerable directories
Add to .htaccess: php_flag engine off
Or: AddHandler text/plain .php .php3 .php4 .php5 .phtml
🧯 If You Can't Patch
- Immediately disable or remove the VideoWhisper Video Presentation plugin
- Implement web application firewall rules to block requests to vp/vw_upload.php and block .phtml file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for plugin version. If VideoWhisper Video Presentation plugin is installed and version is 3.31.17 or earlier, system is vulnerable.Check Version:
Check WordPress admin dashboard > Plugins > VideoWhisper Video Presentation, or examine wp-content/plugins/video-presentation/video-presentation.php header for version number.Verify Fix Applied:
Verify plugin version is 3.31.18 or later in WordPress admin panel. Test that .phtml files cannot be uploaded or executed.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/video-presentation/vp/vw_upload.php
- File uploads with .phtml extension
- Unusual PHP execution in upload directories
Network Indicators:
- POST requests to vulnerable upload endpoint with malicious file uploads
- Subsequent requests to uploaded .phtml files
SIEM Query:
source="web_server" AND (uri="/wp-content/plugins/video-presentation/vp/vw_upload.php" OR filename="*.phtml")