Arbitrary File Upload Patched in WEmanage App Worker WordPress Plugin

On February 1st, 2024, during the Wordfence Bug Bounty Extravaganza, a submission was received for an Arbitrary File Upload vulnerability in Management App for WooCommerce, a WordPress plugin with 1,000+ active installations. This vulnerability makes it possible for authenticated users such as subscribers and customers to upload arbitrary files to a vulnerable site and achieve remote code execution.

Props to Lucio Sá who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $657.00 for this discovery during our Bug Bounty Program Extravaganza.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on February 2, 2024. Sites using the free version of Wordfence received the same protection on March 3, 2024.

Wordfence contacted the WEmanage Team on February 2, 2024. After not receiving a reply we escalated the issue to the WordPress.org Security Team on March 8, 2024. After that, the developer released a patch on March 24, 2024.

We urge users to update their sites with the latest patched version of Management App for WooCommerce, version 1.2.3 at the time of this writing, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2024/04/657-bounty-awarded-for-arbitrary-file-upload-patched-in-wemanage-app-worker-wordpress-plugin/

Posted in Vulnerability.