In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Local File Inclusion in TheCartPress

Our firewall plugin has been blocking attempts trying to exploit what at least one hacker believes to be a vulnerability in the plugin TheCartPress, where the attempt looks like this:

/wp-content/plugins/thecartpress/modules/Miranda.class.php?page=../../../../../../../../wp-config.php

That appears to be related to a report of a claimed vulnerability from 2015, which claimed the vulnerability existed in version 1.4.7 of the plugin. No information beyond a proof of concept was provided for the claim. Trying the proof of concept, which matches the hacking attempt, we didn’t get the result that you would get if there really was a vulnerability. Instead, an error message was shown that started “Fatal error: Uncaught Error: Call to undefined function is_admin()” and referenced line 24 of the file. That error is caused by trying to call a function from WordPress that doesn’t exist when the file is requested directly, so there couldn’t be the vulnerability claimed by the proof of concept.