CVE-2019-15318

Vulnerability

The yikes-inc-easy-mailchimp-extender plugin for WordPress, versions prior to 6.5.3, contains a code injection vulnerability in an admin input field. The plugin fails to properly sanitize or validate user-supplied input within the administrative interface, allowing an authenticated administrator to inject arbitrary PHP code. The vulnerable code path is reachable when the attacker has access to the WordPress admin dashboard and the plugin is active.

Exploitation

An attacker must have valid administrator-level credentials for the WordPress site. With those credentials, the attacker can navigate to the plugin's settings page and inject malicious code into the vulnerable input field. No additional user interaction or special network position is required beyond standard admin access. The injected code is then executed in the context of the WordPress server.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server. This can lead to full compromise of the WordPress site, including data theft, privilege escalation, defacement, or use of the server for further attacks. The attacker gains the same privileges as the web server user, typically resulting in complete control over the site and its data.

Mitigation

The vulnerability is fixed in version 6.5.3 of the plugin. However, as of June 4, 2024, the plugin has been closed and removed from the WordPress.org plugin directory due to a security issue [1]. No patched version is being distributed through official channels. Users who have the plugin installed should uninstall it immediately and migrate to an alternative solution. No workaround is available.