CVE-2015-9499: The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.

PriorityP182critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

14.77%

96.3th percentile

The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
themepunch	showbiz_pro	<= 1.7.1	—

Detection & IOCsextracted from sources · hover to see the quote

path/wp-content/plugins/showbizpro/temp/update_extract/

url/wp-admin/admin.php?page=showbiz&view=sliders

→After a malicious ZIP upload, a PHP webshell is extracted and accessible under the plugin's temp extraction path. Detect HTTP GET requests to /wp-content/plugins/showbizpro/temp/update_extract/*.php with a 200 response, indicating successful PHP code execution.
→Exploitation is confirmed when the server responds HTTP 200 and the response body contains the string 'Update in progress...' alongside the showbiz slider admin URL, indicating the upload/extraction phase succeeded.
→The attack vector involves uploading a ZIP archive containing a .php file to the Showbiz Pro plugin (through version 1.7.1). Monitor multipart/form-data POST requests (WebKitFormBoundary) to the showbiz admin endpoint for ZIP files containing PHP scripts.

·The plugin is only vulnerable through version 1.7.1. Detections should be scoped to environments running Showbiz Pro <= 1.7.1 for WordPress. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.