# MA-615.062016: MyCERT Advisory - WP Mobile Detector Vulnerability

**Date:** 06 Jun 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-615.062016  
**Advisory ID:** MA-615.062016

---

####
**1.0    Introduction**
WP Mobile Detector, a WordPress plugin, contains a vulnerability in versions prior to 3.6.
The WP Mobile Detector WordPress plugin automatically detects if the visitor is using a standard mobile phone or a smart phone and loads a compatible WordPress mobile theme for each.
**2.0    Impact**
Exploitation of this vulnerability could allow an attacker to take control of an affected website.
**3.0    Affected Products**
WP Mobile Detector versions prior to 3.6
**4.0    Recommendation**
MyCERT encourages users and administrators the following options:
4.1    Disable the configuration option allow\_url\_fopen if it is not explicitly needed.
Detail on this is available at:
<https://www.owasp.org/index.php/PHP_Top_5#P1:_Remote_Code_Execution>
4.2    Review the WP Mobile Detector Changelog for more information, and
apply the necessary update.                                                                                       
The changelog is available here:
[https://wordpress.org/plugins/wp-mobile-detector/changelog/](https://wordpress.org/plugins/wp-mobile-detector/changelog/ )
Users can download WP Mobile Detector 3.7 from this URL:
<https://downloads.wordpress.org/plugin/wp-mobile-detector.3.7.zip>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#0d6e746f687f3434344d6e746f687f7e686e787f647974236074) or [[email protected]](/cdn-cgi/l/email-protection#137e6a70766167537e6a707661673d7c61743d7e6a)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
•    [https://www.us-cert.gov/ncas/current-activity/2016/06/03/WP-Mobile-Detector-Vulnerability]( https://www.us-cert.gov/ncas/current-activity/2016/06/03/WP-Mobile-Detector-Vulnerability)
•    <https://wordpress.org/plugins/wp-mobile-detector/changelog/>
•    <https://www.owasp.org/index.php/PHP_Top_5#P1:_Remote_Code_Execution>