WordPress Hungred Post Thumbnail Plugin Arbitrary File Upload Vulnerability
Description
Sammy Forgit has discovered a vulnerability in the Hungred Post Thumbnail plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/font-uploader/font-upload.php script improperly validating the extension of an uploaded file. This can be exploited to execute arbitrary PHP code by uploading a PHP file with an appended ".jpg", ".gif", or ".png" file extension.
Successful exploitation requires that Apache is not configured to handle the mime-type for media files with a ".jpg", ".gif", or ".png" extension (Configured to handle by default).
The vulnerability is confirmed in version 2.1.9. Other versions may also be affected.
Vulnerable Products
Vulnerable Software: WordPress Hungred Post Thumbnail Plugin 2.x
Solution
Restrict access to the wp-content/plugins/font-uploader/font-upload.php script or the wp-content/uploads/hungred-post-thumbnail/images/random/ folder (e.g. via .htaccess).
