CVE-2023-5931
📋 TL;DR
The rtMedia WordPress plugin before version 4.6.16 has an unrestricted file upload vulnerability that allows authenticated users with low privileges (like subscribers) to upload arbitrary files, including PHP scripts, to the server. This affects WordPress sites using rtMedia with BuddyPress or bbPress integration.
💻 Affected Systems
- rtMedia for WordPress, BuddyPress and bbPress
📦 What is this software?
Rtmedia by Rtcamp
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain remote code execution (RCE) by uploading a PHP web shell, leading to complete server compromise, data theft, and lateral movement within the network.
Likely Case
Attackers upload PHP backdoors to establish persistent access, deface websites, or deploy malware for further attacks.
If Mitigated
With proper file validation and server hardening, impact is limited to potential denial of service or storage exhaustion from uploaded files.
🎯 Exploit Status
Exploitation requires at least subscriber-level access. Public proof-of-concept scripts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.16
Vendor Advisory: https://wpscan.com/vulnerability/3d6889e3-a01b-4e7f-868f-af7cc8c7531a
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find rtMedia plugin and click 'Update Now'. 4. Verify version is 4.6.16 or later.
🔧 Temporary Workarounds
Disable File Uploads
allTemporarily disable file upload functionality in rtMedia settings until patched.
Restrict Upload Directory Permissions
linuxSet upload directory permissions to prevent PHP execution.
chmod -R 644 /path/to/wp-content/uploads/rtMedia/
find /path/to/wp-content/uploads/rtMedia/ -type f -name '*.php' -delete
🧯 If You Can't Patch
- Remove or deactivate the rtMedia plugin immediately.
- Implement web application firewall (WAF) rules to block file uploads with PHP extensions.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel under Plugins > Installed Plugins for rtMedia version. If version is below 4.6.16, the site is vulnerable.Check Version:
wp plugin list --name=rtmedia --field=versionVerify Fix Applied:
Confirm rtMedia plugin version is 4.6.16 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to rtMedia directories, especially PHP files.
- HTTP POST requests to /wp-content/plugins/buddypress-media/rtMedia/upload/ with suspicious file extensions.
Network Indicators:
- POST requests uploading files with .php, .phtml, or other executable extensions to rtMedia endpoints.
SIEM Query:
source="web_logs" AND uri_path="/wp-content/plugins/buddypress-media/rtMedia/upload/" AND (file_extension="php" OR file_extension="phtml")