CVE-2018-17573
Description
The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The plugin bundles an unmodified, unconfigured FCKeditor instance whose file upload connectors allow uploading arbitrary file types without authentication."
Attack vector
An attacker can navigate directly to the exposed FCKeditor file manager pages, such as `uploadtest.html`, which are bundled with the wp-insert plugin and accessible without authentication [ref_id=1]. Because FCKeditor's file upload connectors do not restrict file types, the attacker can upload a PHP web shell or other executable code to the server [ref_id=1]. Once uploaded, the attacker accesses the uploaded file directly via its URL, causing the PHP code to execute on the server [ref_id=1].
Affected code
The vulnerable code resides in the bundled FCKeditor files under the wp-insert plugin directory: `fckeditor/editor/filemanager/browser/default/browser.html`, `fckeditor/editor/filemanager/connectors/test.html`, and `fckeditor/editor/filemanager/connectors/uploadtest.html` [ref_id=1]. These FCKeditor components are exposed and configured in a way that allows arbitrary file upload without authentication or file-type restrictions [ref_id=1].
What the fix does
The advisory states that version 2.4.2 and earlier are affected and that the plugin remains "unpatched" [ref_id=1]. No patch is provided in the bundle. The recommended remediation is to remove or disable the bundled FCKeditor components entirely, or to replace them with a secure file upload mechanism that validates file types and requires authentication [ref_id=1].
Preconditions
- configThe WordPress site must have the WP-Insert plugin (version 2.4.2 or earlier) installed and active.
- networkThe attacker must be able to reach the exposed FCKeditor URLs over HTTP/HTTPS (no authentication required).
- configThe web server must have write permissions to the upload directory used by FCKeditor.
Reproduction
1. Navigate to `http://
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- cxsecurity.com/issue/WLB-2018090255mitrex_refsource_MISC
- packetstormsecurity.com/files/149568/WordPress-WP-Insert-2.4.2-Arbitrary-File-Upload.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.