CVE-2018-16283
📋 TL;DR
This vulnerability allows attackers to perform directory traversal attacks through the Image.php URL parameter in the Wechat Broadcast WordPress plugin. Attackers can read arbitrary files on the server, potentially accessing sensitive configuration files, credentials, or other critical data. WordPress sites using Wechat Broadcast plugin version 1.2.0 or earlier are affected.
💻 Affected Systems
- WordPress Wechat Broadcast Plugin
📦 What is this software?
Wechat Brodcast by Wechat Brodcast Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like wp-config.php (containing database credentials), followed by database takeover, privilege escalation, and lateral movement.
Likely Case
Sensitive file disclosure including configuration files, user data, and potentially credentials leading to unauthorized access.
If Mitigated
Limited impact with proper file permissions and web server configuration preventing access to sensitive files.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1 or later
Vendor Advisory: https://github.com/springjk/wordpress-wechat-broadcast/issues/14
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find Wechat Broadcast plugin. 4. Update to version 1.2.1 or later. 5. Alternatively, deactivate and delete the plugin if not needed.
🔧 Temporary Workarounds
Disable Wechat Broadcast Plugin
allDeactivate the vulnerable plugin to prevent exploitation
wp plugin deactivate wechat-broadcast
Web Server Directory Restriction
allConfigure web server to restrict directory traversal attempts
# Apache: Add to .htaccess
<Files "Image.php">
Order Allow,Deny
Deny from all
</Files>
# Nginx: Add to server block
location ~* /Image\.php$ {
deny all;
}
🧯 If You Can't Patch
- Remove the Wechat Broadcast plugin entirely from the WordPress installation
- Implement web application firewall (WAF) rules to block directory traversal patterns in URLs
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Wechat Broadcast plugin version. If version is 1.2.0 or earlier, you are vulnerable.Check Version:
wp plugin get wechat-broadcast --field=versionVerify Fix Applied:
After updating, verify plugin version shows 1.2.1 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or directory traversal patterns to Image.php
- Multiple 200 OK responses to Image.php with unusual file paths
- Access to sensitive files like wp-config.php from unexpected sources
Network Indicators:
- HTTP GET requests to /wp-content/plugins/wechat-broadcast/Image.php with URL parameters containing '../' sequences
SIEM Query:
source="web_server_logs" AND (url="*Image.php*" AND (url="*../*" OR url="*..%2f*" OR url="*..%5c*"))🔗 References
- http://seclists.org/fulldisclosure/2018/Sep/32
- https://github.com/springjk/wordpress-wechat-broadcast/issues/14
- https://wpvulndb.com/vulnerabilities/9132
- https://www.exploit-db.com/exploits/45438/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/150202
- http://seclists.org/fulldisclosure/2018/Sep/32
- https://github.com/springjk/wordpress-wechat-broadcast/issues/14
- https://wpvulndb.com/vulnerabilities/9132
- https://www.exploit-db.com/exploits/45438/
