{"vulnerability": "CVE-2021-42362", "sightings": [{"uuid": "66e5691d-8a11-4600-bfef-6175ab9da679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "c2424c9f-bb2b-4d0a-bc05-d232c1f33d99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:40.000000Z"}, {"uuid": "afae9d25-cc72-4b8e-bd01-4b42b76481c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_popular_posts_rce.rb", "content": "", "creation_timestamp": "2021-12-20T15:49:01.000000Z"}, {"uuid": "94845aad-277a-463d-a76e-13e2009b4fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "published-proof-of-concept", "source": "Telegram/ZJp_VCEhaga9OM9NBvz45K3ssC6nL69JeV_dGqoHwNSpsGU", "content": "", "creation_timestamp": "2025-04-15T05:00:08.000000Z"}, {"uuid": "b1cf3db8-b015-4d55-881e-2b8aeb1afd27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "https://t.me/cibsecurity/32531", "content": "\u203c CVE-2021-42362 \u203c\n\nThe WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T20:14:39.000000Z"}, {"uuid": "04891e46-5832-4c17-bfde-719879509ef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_popular_posts_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"h00die\", \"Simone Cristofaro\", \"Jerome Bruandet\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080.\\n          The FQDN must also not resolve to a reserved address (192/172/127/10).  The server must also respond to a HEAD request\\n          for the payload, prior to getting a GET request.\\n          This exploit leverages an authenticated improper input validation in Wordpress plugin Popular Posts <= 5.3.2.\\n          The exploit chain is rather complicated.  Authentication is required and 'gd' for PHP is required on the server.\\n          Then the Popular Post plugin is reconfigured to allow for an arbitrary URL for the post image in the widget.\\n          A post is made, then requests are sent to the post to make it more popular than the previous #1 by 5. Once\\n          the post hits the top 5, and after a 60sec (we wait 90) server cache refresh, the homepage widget is loaded\\n          which triggers the plugin to download the payload from our server. Our payload has a 'GIF' header, and a\\n          double extension ('.gif.php') allowing for arbitrary PHP code to be executed.\", \"disclosure_date\": \"2021-06-11\", \"fullname\": \"exploit/multi/http/wp_popular_posts_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Wordpress Popular Posts Authenticated RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_popular_posts_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"multi/http/wp_popular_posts_rce\", \"references\": [\"EDB-50129\", \"URL-https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/\", \"WPVDB-bd4f157c-a3d7-4535-a587-0102ba4e3009\", \"URL-https://plugins.trac.wordpress.org/changeset/2542638\", \"URL-https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601\", \"CVE-2021-42362\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:22.696227Z"}]}