CVE-2023-51419
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files, including malicious scripts, to WordPress sites running the vulnerable BERTHA AI plugin. It affects all versions up to 1.11.10.7, potentially leading to remote code execution or site takeover. Users of the BERTHA AI plugin for WordPress are at risk.
💻 Affected Systems
- BERTHA AI. Your AI co-pilot for WordPress and Chrome
📦 What is this software?
Bertha Ai by Bertha
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via remote code execution, leading to data theft, defacement, or ransomware deployment.
Likely Case
Website defacement, malware injection, or backdoor installation for persistent access.
If Mitigated
Limited impact if file uploads are restricted via web application firewalls or server-side controls.
🎯 Exploit Status
Exploitation is straightforward, with public proof-of-concept details available online.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.10.8 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins > Installed Plugins. 3. Find BERTHA AI plugin and update to version 1.11.10.8 or higher. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable plugin
allTemporarily deactivate the BERTHA AI plugin to prevent exploitation.
wp plugin deactivate bertha-ai-free
Restrict file uploads via .htaccess
linuxBlock uploads of dangerous file types (e.g., .php, .exe) in the WordPress uploads directory.
Add to .htaccess in wp-content/uploads: <FilesMatch "\.(php|exe|phtml)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Implement a web application firewall (WAF) to block malicious file upload attempts.
- Monitor file upload directories for suspicious files and restrict write permissions.
🔍 How to Verify
Check if Vulnerable:
Check the plugin version in WordPress admin under Plugins > Installed Plugins; if version is 1.11.10.7 or lower, it is vulnerable.Check Version:
wp plugin get bertha-ai-free --field=versionVerify Fix Applied:
Confirm the plugin version is 1.11.10.8 or higher after updating.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wp-content/uploads/ directory, especially .php files from unauthenticated users.
Network Indicators:
- HTTP POST requests to plugin-specific endpoints with file upload parameters.
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/bertha-ai-free/*" AND method="POST" AND file_extension IN ("php", "exe", "phtml")🔗 References
- https://patchstack.com/database/vulnerability/bertha-ai-free/wordpress-bertha-ai-plugin-1-11-10-7-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/bertha-ai-free/wordpress-bertha-ai-plugin-1-11-10-7-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
