Not Really a WordPress Plugin Vulnerability, Week of December 21
In reviewing reports of vulnerabilities in WordPress plugins we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to level of getting their own post we now place them in a weekly post when we come across them.
Shell Upload in Dean’s FCKEditor For WordPress and Monsters Editor for WP Super Edit
Related reports of claimed shell upload vulnerabilities were released for Dean’s FCKEditor For WordPress and Monsters Editor for WP Super Edit this week. The claim is that both of them contain
a very serious vulnerability that allowed hackers to gain full control a modify, upload and execute files on any website running WordPress. With the
plugin installed on a certain website, a hacker or malicious person can gain access to the web server via HTTP through a backdoor in the pluginas directory.”
In reality the relevant upload functionality is disabled in them and the file that is claimed to be vulnerable is a .html file that would be a frontend for uploads if the upload functionality was enabled (instead of the file that would even handle the file upload), which it isn’t.
How come you’re not catching these upload vulnerabilities? a .html file is dangerous if your site winds up having illegal or malicious content uploaded to it and you lose your customers trust. I think you have a very narrow view of web site security.
Your comment seems to be unrelated to what is discussed in this post, as the claim was not that .html files could be uploaded and the upload functionality is not enabled, so no matter the extension, files couldn’t be uploaded.