CVE-2019-15858

published 2019-09-03

CVE-2019-15858: admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by…

Priority P2 65 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

EXPLOIT

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
webcraftic	woody_ad_snippets	< 2.2.5	2.2.5

Detection & IOCs extracted from sources · hover to see the quote

path admin/includes/class.import.snippet.php↗

• → Probe for vulnerable plugin version by fetching the readme.txt of the 'insert-php' (Woody Ad Snippets) plugin and checking that the body contains 'Changelog' and 'Woody ad snippets' but does NOT contain version string '2.2.5'.
• → The vulnerability is exploitable without authentication — any unauthenticated HTTP request to the import endpoint (admin/includes/class.import.snippet.php) can import arbitrary options, including XSS/RCE payloads.

• · The Nuclei template uses only a single GET request to the readme.txt file for version detection; it does not actively exploit the import endpoint. A 200 response containing 'Changelog' and 'Woody ad snippets' without '2.2.5' indicates a vulnerable installation.

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306