CVE-2017-1002003: Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from…

PriorityP261critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

12.44%

95.7th percentile

Vulnerability in wordpress plugin wp2android-turn-wp-site-into-android-app v1.1.4, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
invedion	wp2android-turn-wp-site-into-android-app	>= unspecified < 1.1.4	1.1.4
wp2android-turn-wp-site-into-android-app_project	wp2android-turn-wp-site-into-android-app	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/wp-content/plugins/wp2android-turn-wp-site-into-android-app/↗

command?alien=whoami↗

command?alien=command↗

→Detect arbitrary file upload attempts targeting WordPress plugin directories via HTTP POST with multipart file data ↗
→Alert on HTTP GET requests containing the query parameter '?alien=' which is the webshell command execution parameter used by the uploaded shell ↗
→Monitor for file uploads to /wp-content/plugins/wp2android-turn-wp-site-into-android-app/ directory, especially executable script files ↗

·The vulnerable plugin version is specifically v1.1.4; verify installed version before applying detections to avoid false positives on patched installs ↗
·The exploit targets multiple WordPress plugins (not just wp2android), so the file upload and ?alien= shell parameter detections apply broadly across affected plugin paths ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.