CVE-2015-9499
📋 TL;DR
The Showbiz Pro WordPress plugin through version 1.7.1 contains an unrestricted file upload vulnerability that allows attackers to upload PHP files via ZIP archives, leading to remote code execution. This affects any WordPress site using the vulnerable plugin version. Attackers can gain complete control of affected websites.
💻 Affected Systems
- Showbiz Pro WordPress Plugin
📦 What is this software?
Showbiz Pro by Themepunch
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing arbitrary code execution, data theft, website defacement, and lateral movement to other systems.
Likely Case
Website takeover, malware installation, credential theft, and backdoor persistence.
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls in place.
🎯 Exploit Status
Multiple public exploit scripts available, trivial to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.2 or later
Vendor Advisory: https://wpvulndb.com/vulnerabilities/7955
Restart Required: No
Instructions:
1. Update Showbiz Pro plugin to version 1.7.2 or later via WordPress admin panel. 2. Verify update completed successfully. 3. Remove any previously uploaded suspicious files.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable Showbiz Pro plugin until patched
wp plugin deactivate showbiz-pro
Restrict file uploads
allBlock .php file uploads via web server configuration
<FilesMatch "\.php$">
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Remove Showbiz Pro plugin completely and use alternative
- Implement strict file upload validation and monitoring
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for Showbiz Pro plugin version 1.7.1 or earlierCheck Version:
wp plugin list --name=showbiz-pro --field=versionVerify Fix Applied:
Confirm plugin version is 1.7.2 or later in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/plugins/showbiz-pro/
- POST requests to showbiz-pro upload endpoints with .zip files
Network Indicators:
- HTTP POST requests containing ZIP archives to plugin upload handlers
SIEM Query:
source="web_logs" AND uri="*showbiz*" AND method="POST" AND file_ext="zip"🔗 References
- https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_showbiz_file_upload.rb
- https://wpvulndb.com/vulnerabilities/7955
- https://www.exploit-db.com/exploits/35385
- https://github.com/espreto/wpsploit/blob/master/modules/exploits/unix/webapp/wp_showbiz_file_upload.rb
- https://wpvulndb.com/vulnerabilities/7955
- https://www.exploit-db.com/exploits/35385
