CVE-2021-24254
📋 TL;DR
The College Publisher Import WordPress plugin through version 0.1 allows authenticated administrators to upload arbitrary files including PHP scripts, leading to remote code execution. The vulnerability can also be exploited via CSRF attacks due to lack of CSRF protection. This affects WordPress sites using the vulnerable plugin version.
💻 Affected Systems
- College Publisher Import WordPress Plugin
📦 What is this software?
College Publisher Import by College Publisher Import Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary code, install backdoors, steal data, or pivot to other systems.
Likely Case
Website defacement, malware installation, data theft, or use as part of a botnet.
If Mitigated
Limited impact with proper file upload restrictions and CSRF protections in place.
🎯 Exploit Status
Exploitation requires administrator credentials or successful CSRF attack against an administrator.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None available
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Remove the College Publisher Import plugin completely. 2. Verify no malicious files were uploaded during exploitation. 3. Consider using alternative import plugins with proper security controls.
🔧 Temporary Workarounds
Disable plugin
linuxCompletely remove the vulnerable plugin from WordPress
wp plugin delete college-publisher-import
Restrict file uploads
allConfigure web server to block PHP file execution in upload directories
<FilesMatch "\.php$">
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Implement strict file upload validation in web application firewall
- Enable CSRF protection globally and monitor for suspicious administrator activity
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for College Publisher Import plugin version 0.1 or earlierCheck Version:
wp plugin list --name=college-publisher-import --field=versionVerify Fix Applied:
Confirm plugin is removed from wp-content/plugins directory and not listed in WordPress admin📡 Detection & Monitoring
Log Indicators:
- PHP file uploads to plugin directories
- CSV import requests with unusual file extensions
- Administrator account performing unexpected file uploads
Network Indicators:
- POST requests to /wp-admin/admin.php?page=college-publisher-import with file uploads
- Unexpected PHP file execution from upload directories
SIEM Query:
source="web_logs" AND (uri="/wp-admin/admin.php?page=college-publisher-import" OR file_extension="php") AND action="upload"🔗 References
- https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/College%20Puglisher%20Import.md
- https://wpscan.com/vulnerability/bb3e56dd-ae2e-45c2-a6c9-a59ae5fc1dc4
- https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/College%20Puglisher%20Import.md
- https://wpscan.com/vulnerability/bb3e56dd-ae2e-45c2-a6c9-a59ae5fc1dc4
