Shinya Murakami

An unauthenticated file upload flaw allows remote attackers to upload arbitrary files to a site through a form file field because the plugin fails to validate file types or extensions. A failure in the temporary-file cleanup process ensures the uploaded file remains on the disk. This issue potentially affects over 5 million WordPress sites. On stock Debian or Ubuntu Apache configurations that list directory contents and map .phar files to the PHP handler, this can lead to Remote Code Execution (RCE), which is the ability to execute arbitrary commands on the server. On other configurations, such as nginx or Apache with .htaccess overrides, the flaw allows arbitrary files to be written into the uploads directory, which may be served as active content like HTML or SVG.

Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the `ImageURL column value (populated from wp usermeta.description in the demonstrated path)` parameter. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them. This requires an administrator to have published a DataTables shortcode over a database column controlled by the attacker, such as `wp usermeta.description`, with the Image URL media type assigned to that column.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue is only exploitable if a Google Maps API key is configured in the settings, as the vulnerable sink is only reached under this condition. The flaw is triggered via the `lat` parameter.

An unrestricted file upload issue exists in the campaign import feature. When processing a campaign archive, the application copies bundled asset files into a publicly accessible media directory without restricting file names or types. An authenticated user with permissions to create campaign imports can exploit this via the user interface or the '/api/campaigns/import' endpoint to place arbitrary files, such as server-side scripts, in the web root. This does not require administrator privileges. On web servers that honor per-directory configuration, such as the default Apache setup in the official Mautic Docker image, this can lead to remote code execution with the privileges of the web server user, granting access to application secrets, configuration, and contact data.