CVE-2023-5815

published 2023-11-22

CVE-2023-5815: The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for…

Priority P1 83 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for WordPress is vulnerable to Remote Code Execution via Local File Inclusion in all versions up to, and including, 3.4.1 via the bdp_get_more_post function hooked via a nopriv AJAX. This is due to function utilizing an unsafe extract() method to extract values from the POST variable and passing that input to the include() function. This makes it possible for unauthenticated attackers to include arbitrary PHP files and achieve remote code execution. On vulnerable Docker configurations it may be possible for an attacker to create a PHP file and then subsequently include it to achieve RCE.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
infornweb	news_blog_designer_pack	<= 3.4.1	—

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php↗

command action=bdp_get_more_post&shrt_param[design]=../../../../../wp-login↗

path /wp-content/plugins/blog-designer-pack/↗

• → Monitor for unauthenticated POST requests to /wp-admin/admin-ajax.php with the action parameter set to 'bdp_get_more_post', which is the nopriv AJAX hook exploited by this vulnerability. ↗
• → Detect POST body containing 'shrt_param[design]' with path traversal sequences (e.g., '../') as this is the parameter used to pass the malicious file path to include(). ↗
• → Flag exploitation of unsafe extract() on POST variables passed directly to include(), enabling Local File Inclusion leading to RCE in the bdp_get_more_post function. ↗
• → On Docker-based WordPress deployments, watch for creation of new PHP files followed by AJAX-based LFI requests, as this is the known RCE path on vulnerable Docker configurations (e.g., via pearcmd.php). ↗
• → Successful exploitation returns a JSON response with both '"success"' and '"data"' fields and HTTP 200 with Content-Type application/json; use this as a post-exploitation detection signal. ↗

• · Exploitation is only possible against plugin versions up to and including 3.4.1; patched versions are not vulnerable. ↗
• · RCE via file creation (e.g., pearcmd.php technique) is specific to vulnerable Docker configurations; standard WordPress installs may only be exploitable for LFI/information disclosure unless a writable PHP file already exists. ↗
• · The CVSS score of 8.1 reflects High attack complexity (AC:H), meaning reliable RCE requires specific environmental conditions (e.g., Docker); LFI alone is more broadly achievable. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 8.1 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-98