CVE-2016-1000112
📋 TL;DR
The Contus Video Comments WordPress plugin version 1.0 contains an unauthenticated remote file upload vulnerability that allows attackers to upload arbitrary files, including malicious PHP scripts disguised as JPG images. This affects any WordPress site running the vulnerable plugin version. Attackers can exploit this without authentication to gain control of affected websites.
💻 Affected Systems
- Contus Video Comments WordPress Plugin
📦 What is this software?
Contus Video Comments by Contussupport
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, defacement, malware distribution, or use as part of a botnet.
Likely Case
Website defacement, backdoor installation, credential theft, and lateral movement within the hosting environment.
If Mitigated
Limited impact if file uploads are restricted at web server level or if plugin is disabled.
🎯 Exploit Status
Simple HTTP POST request with crafted file upload bypasses authentication and file type validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
1. Immediately remove the Contus Video Comments plugin from all WordPress installations. 2. Delete all plugin files from the wp-content/plugins directory. 3. Search for and remove any suspicious files uploaded via this vulnerability.
🔧 Temporary Workarounds
Disable Plugin
allDeactivate and delete the vulnerable plugin from WordPress admin panel.
Navigate to WordPress Admin > Plugins > Installed Plugins > Deactivate and Delete Contus Video Comments
Restrict File Uploads
linuxConfigure web server to block file uploads to the vulnerable endpoint.
For Apache: Add 'Deny from all' to .htaccess in plugin directory
For Nginx: Add 'location ~* /wp-content/plugins/contus-video-comments/ { deny all; }' to server config
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to the vulnerable upload endpoint.
- Enable file integrity monitoring on wp-content/uploads directory to detect unauthorized file uploads.
🔍 How to Verify
Check if Vulnerable:
Check if /wp-content/plugins/contus-video-comments/ directory exists on WordPress installation.Check Version:
Check WordPress database: SELECT * FROM wp_options WHERE option_name = 'active_plugins'; (look for contus-video-comments)Verify Fix Applied:
Confirm plugin directory is removed and no longer appears in WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/contus-video-comments/upload.php with .jpg files
- File uploads to unusual directories with .php extensions
Network Indicators:
- Unusual outbound connections from web server following file uploads
- Spike in traffic to upload.php endpoint
SIEM Query:
source="web_server" AND (uri_path="/wp-content/plugins/contus-video-comments/upload.php" OR file_extension="php" AND upload_success="true")