CVE-2023-6140
📋 TL;DR
The Essential Real Estate WordPress plugin before version 4.4.0 allows low-privileged users like subscribers to upload malicious PHP files disguised as ZIP archives. This vulnerability could lead to remote code execution on affected WordPress sites. Any WordPress site using vulnerable versions of this plugin is affected.
💻 Affected Systems
- Essential Real Estate WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining complete control over the WordPress site and potentially the underlying server through remote code execution.
Likely Case
Attacker uploads a web shell, gains persistent access to the site, defaces content, steals data, or installs malware.
If Mitigated
Attack fails due to proper file upload restrictions or user privilege limitations.
🎯 Exploit Status
Exploitation requires subscriber-level access. Attackers can create subscriber accounts if registration is open.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.0
Vendor Advisory: https://wpscan.com/vulnerability/c837eaf3-fafd-45a2-8f5e-03afb28a765b
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Essential Real Estate plugin. 4. Click 'Update Now' if update is available. 5. If no update appears, manually update to version 4.4.0 or later from WordPress plugin repository.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the Essential Real Estate plugin until patched
wp plugin deactivate essential-real-estate
Restrict user registration
allDisable new user registration to prevent attacker account creation
🧯 If You Can't Patch
- Remove subscriber and lower-privileged user accounts
- Implement web application firewall rules to block PHP file uploads
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Essential Real Estate versionCheck Version:
wp plugin get essential-real-estate --field=versionVerify Fix Applied:
Confirm plugin version is 4.4.0 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads by subscriber-level users
- PHP file execution from uploads directory
- Multiple failed login attempts followed by successful subscriber login
Network Indicators:
- HTTP POST requests to upload endpoints from unexpected sources
- Unusual outbound connections from web server
SIEM Query:
source="wordpress.log" AND ("upload" OR "subscriber") AND ("php" OR "zip")