CVE-2017-1002000 – This vulnerability allows unauthenticated attac... (How to Fix)

Q: What is the severity of CVE-2017-1002000?

CVE-2017-1002000 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows unauthenticated attackers to upload arbitrary files to WordPress sites using the mobile-friendly-app-builder-by-easytouch plugin v3.0. The flaw exists in the images.php file which lacks authentication checks, enabling remote code execution. All WordPress installations with this vulnerable plugin version are affected.

📋 TL;DR

This vulnerability allows unauthenticated attackers to upload arbitrary files to WordPress sites using the mobile-friendly-app-builder-by-easytouch plugin v3.0. The flaw exists in the images.php file which lacks authentication checks, enabling remote code execution. All WordPress installations with this vulnerable plugin version are affected.

💻 Affected Systems

Products:

mobile-friendly-app-builder-by-easytouch WordPress plugin

Versions: Version 3.0

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects WordPress installations with this specific plugin version. The vulnerability is present in default plugin configuration.

📦 What is this software?

Mobile Friendly App Builder By Easytouch by Mobile Friendly App Builder By Easytouch Project

View all CVEs affecting Mobile Friendly App Builder By Easytouch →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the WordPress site through remote code execution, allowing attackers to deface websites, steal data, install backdoors, or pivot to internal networks.

🟠

Likely Case

Attackers upload web shells or malicious files to gain persistent access, deface websites, or use the compromised server for further attacks.

🟢

If Mitigated

With proper file upload restrictions and web application firewalls, impact is limited to potential denial of service or temporary disruption.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit code is publicly available on Exploit-DB (ID 41540). Attack requires no authentication and minimal technical skill.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 3.0.1 or later

Vendor Advisory: https://wordpress.org/plugins-wp/mobile-friendly-app-builder-by-easytouch/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Mobile Friendly App Builder by EasyTouch'. 4. Click 'Update Now' if available. 5. If no update available, deactivate and delete the plugin immediately.

🔧 Temporary Workarounds

Disable vulnerable endpoint

all

Block access to the vulnerable images.php file via web server configuration

# For Apache: add to .htaccess
<Files "images.php">
    Order Allow,Deny
    Deny from all
</Files>
# For Nginx: add to server block
location ~ /mobile-friendly-app-builder-by-easytouch/server/images\.php$ {
    deny all;
    return 403;
}

Remove vulnerable plugin

all

Completely remove the vulnerable plugin from the WordPress installation

# Via WordPress CLI
wp plugin deactivate mobile-friendly-app-builder-by-easytouch
wp plugin delete mobile-friendly-app-builder-by-easytouch
# Manual removal
rm -rf /path/to/wordpress/wp-content/plugins/mobile-friendly-app-builder-by-easytouch/

🧯 If You Can't Patch

Immediately deactivate and remove the mobile-friendly-app-builder-by-easytouch plugin from all WordPress installations.
Implement strict web application firewall rules to block file upload attempts to the vulnerable endpoint.

🔍 How to Verify

Check if Vulnerable:

Check if the plugin exists: ls -la /path/to/wordpress/wp-content/plugins/ | grep mobile-friendly-app-builder-by-easytouch. Check version in plugin header or WordPress admin panel.

Check Version:

wp plugin get mobile-friendly-app-builder-by-easytouch --field=version

Verify Fix Applied:

Verify plugin is updated to version 3.0.1+ or completely removed. Test that /wp-content/plugins/mobile-friendly-app-builder-by-easytouch/server/images.php returns 403 or 404.

📡 Detection & Monitoring

Log Indicators:

HTTP POST requests to /wp-content/plugins/mobile-friendly-app-builder-by-easytouch/server/images.php
File uploads to unusual locations, especially PHP files in uploads directory
Multiple 403 errors followed by successful 200 responses to the vulnerable endpoint

Network Indicators:

Unusual outbound connections from WordPress server after file uploads
Traffic patterns showing file uploads to plugin-specific paths

SIEM Query:

source="web_server" AND (url="*mobile-friendly-app-builder-by-easytouch/server/images.php*" OR url="*images.php*" AND user_agent!="WordPress*")

📊 Metadata

CVE ID: CVE-2017-1002000

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: September 14, 2017

Last Updated: April 20, 2025

🔗 References

http://www.securityfocus.com/bid/96899 Third Party Advisory,VDB Entry
http://www.securityfocus.com/bid/96905 Third Party Advisory,VDB Entry
http://www.vapidlabs.com/advisory.php?v=179 Exploit,Third Party Advisory
https://wordpress.org/plugins-wp/mobile-friendly-app-builder-by-easytouch/ Not Applicable
https://www.exploit-db.com/exploits/41540/ Exploit,Third Party Advisory,VDB Entry
http://www.securityfocus.com/bid/96899 Third Party Advisory,VDB Entry
http://www.securityfocus.com/bid/96905 Third Party Advisory,VDB Entry
http://www.vapidlabs.com/advisory.php?v=179 Exploit,Third Party Advisory
https://wordpress.org/plugins-wp/mobile-friendly-app-builder-by-easytouch/ Not Applicable
https://www.exploit-db.com/exploits/41540/ Exploit,Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2017-1002000, you might also want to check these: