CVE-2021-25119
📋 TL;DR
The AGIL WordPress plugin through version 1.0 has an unrestricted file upload vulnerability that allows authenticated administrators to upload arbitrary files, including PHP scripts, leading to remote code execution. This affects WordPress sites running the vulnerable plugin version. Attackers with admin credentials can achieve full server compromise.
💻 Affected Systems
- AGIL WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining shell access, installing backdoors, stealing data, and using the server for further attacks.
Likely Case
Attacker uploads web shell and gains persistent access to the WordPress server, potentially compromising the entire site and database.
If Mitigated
No impact if proper file type validation is implemented or plugin is disabled/removed.
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once obtained. Public exploit details exist in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None - plugin appears abandoned
Vendor Advisory: https://wpscan.com/vulnerability/47235989-d9f1-48a5-9799-fdef0889bf8a
Restart Required: No
Instructions:
1. Remove the AGIL plugin completely from your WordPress installation. 2. Delete all plugin files from /wp-content/plugins/agil/. 3. Verify no residual files remain.
🔧 Temporary Workarounds
Disable Plugin
allDeactivate the AGIL plugin in WordPress admin panel to prevent exploitation.
Navigate to WordPress Admin > Plugins > Installed Plugins > Deactivate AGIL
Restrict File Uploads
linuxAdd server-side restrictions to block PHP file uploads via .htaccess or web server config.
Add to .htaccess: <FilesMatch "\.(php|php5|php7|phtml)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Remove admin access from untrusted users and implement strong password policies
- Implement web application firewall rules to block suspicious file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for AGIL plugin version 1.0 or earlier.Check Version:
WordPress admin panel or check /wp-content/plugins/agil/ readme.txt fileVerify Fix Applied:
Confirm AGIL plugin is completely removed from /wp-content/plugins/ directory and not listed in WordPress plugins.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to WordPress uploads directory
- POST requests to plugin endpoints with zip files
- Execution of unexpected PHP files in uploads directory
Network Indicators:
- HTTP POST requests containing zip files to /wp-content/plugins/agil/ endpoints
- Subsequent requests to newly uploaded PHP files
SIEM Query:
source="web_server" AND (uri_path="/wp-content/plugins/agil/" AND method="POST" AND file_extension="zip")