CVE-2022-4949
📋 TL;DR
The AdSanity WordPress plugin up to version 1.8.1 contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to upload arbitrary files to the server. This can lead to remote code execution by uploading malicious files like PHP shells. WordPress sites using vulnerable AdSanity plugin versions are affected.
💻 Affected Systems
- WordPress AdSanity Plugin
📦 What is this software?
Adsanity by Adsanityplugin
Xen by Xen
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through remote code execution, allowing attackers to steal data, install malware, or pivot to other systems.
Likely Case
Website defacement, data theft, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper file upload restrictions and web application firewalls are in place.
🎯 Exploit Status
Exploitation requires valid WordPress user account with Contributor privileges. Public exploit code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.2 or later
Vendor Advisory: https://wordpress.org/plugins/adsanity/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find AdSanity plugin. 4. Click 'Update Now' if available. 5. If not, download version 1.8.2+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable AdSanity Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate adsanity
Restrict File Uploads via .htaccess
linuxBlock execution of uploaded files in wp-content/uploads/adsanity directory.
<FilesMatch "\.(php|php5|php7|phtml|phar)$">\n Order Allow,Deny\n Deny from all\n</FilesMatch>
🧯 If You Can't Patch
- Remove Contributor and higher role permissions from untrusted users
- Implement web application firewall rules to block malicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > AdSanity version. If version is 1.8.1 or lower, you are vulnerable.Check Version:
wp plugin get adsanity --field=versionVerify Fix Applied:
Verify AdSanity plugin version is 1.8.2 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /wp-content/uploads/adsanity/
- POST requests to /wp-admin/admin-ajax.php with action=adsanity_ajax_upload
Network Indicators:
- HTTP POST requests uploading files with non-image extensions to AdSanity endpoints
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND post_data="adsanity_ajax_upload")🔗 References
- http://www.openwall.com/lists/oss-security/2023/11/09/3
- http://xenbits.xen.org/xsa/advisory-443.html
- https://blog.nintechnet.com/critical-vulnerability-in-wordpress-adsanity-plugin/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/effd72d2-876d-4f8d-b1e4-5ab38eab401b?source=cve
- http://www.openwall.com/lists/oss-security/2023/11/09/3
- http://xenbits.xen.org/xsa/advisory-443.html
- https://blog.nintechnet.com/critical-vulnerability-in-wordpress-adsanity-plugin/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/effd72d2-876d-4f8d-b1e4-5ab38eab401b?source=cve
