CVE-2021-42362

Executive Summary

CVE-2021-42362 is an authenticated arbitrary file upload vulnerability affecting the WordPress Popular Posts plugin, versions up to and including 5.3.2. The flaw resides in insufficient input file type validation within the ~/src/Image.php file, allowing attackers with contributor-level access or higher to upload malicious files that can be leveraged for Remote Code Execution (RCE). With a CVSS score of 8.8 and an EPSS percentile of 99.6%, this vulnerability presents a critical risk to WordPress sites running the affected plugin, potentially enabling full site compromise.

Technical Analysis

The vulnerability exists in the WordPress Popular Posts plugin's image handling component. According to the NVD description, the affected file is ~/src/Image.php, which is responsible for processing image uploads. The core issue is insufficient input file type validation — the application fails to adequately verify that uploaded files match expected image MIME types and legitimate file extensions.

Vulnerability Mechanism:

The attack class is an Authenticated Arbitrary File Upload. The plugin accepts file uploads but inadequately validates the file type. This means an authenticated user with low-privilege access (contributor level or above) can craft a malicious file — potentially a PHP web shell, a .htaccess file, or another executable web content file — and upload it through the plugin's image processing functionality.

Attack Surface:

• Precondition: Attacker must possess valid WordPress credentials with at least contributor role privileges.
• Entry Point: The plugin's image upload logic within ~/src/Image.php — the file path is explicitly noted in the NVD description.
• Impact chain: Arbitrary file upload → stored malicious file on the server → execution via web server → Remote Code Execution (RCE).

Code-Level Analysis:

The NVD description references the file path ~/src/Image.php but does not provide specific function names, validation logic details, or the exact flawed code. The described vulnerability is consistent with a pattern where the application checks file extension superficially but fails to validate actual file content (magic bytes) or MIME type from the Content-Type header. Without source-level detail, the exact validation gap remains unspecified in public advisories.

Why This Is Critical:

Unlike many upload vulnerabilities requiring admin access, this flaw requires only contributor privileges — a significantly lower access tier. In WordPress, contributors can write posts but typically cannot publish them; however, if the upload logic does not adequately gate on capabilities, the plugin inadvertently extends file upload rights to these lower-privileged users.

Exploitation Scenarios

No public PoC is available for this CVE; the attack chain below is inferred from the vulnerability class and NVD description.

Step 1: Reconnaissance & Target Identification

• An attacker scans the internet for WordPress sites running version ≤ 5.3.2 of the Popular Posts plugin (e.g., via WPScan enumeration, fingerprinting of the plugin's static assets, or content-specific indicators in the site source).
• Alternatively, the attacker may already have compromised or valid contributor credentials through phishing, credential stuffing (given the 99.6% EPSS percentile, this CVE is likely chained in automated attack campaigns), or leaked credential databases.

Step 2: Triggering the Flaw

• Authenticate to the target WordPress admin/editor dashboard with a contributor-level account.
• Navigate to a feature that invokes the image upload functionality handled by ~/src/Image.php — the attacker interacts with the plugin's upload interface.
• Craft a malicious file (e.g., a PHP webshell renamed to image.php, where the extension passes a shallow validation check, or a file with double extension like shell.php.png) and submit it through the upload form.

Step 3: Payload Execution

• During the upload, the plugin fails to validate the file's true content type — the file is accepted and stored in the WordPress uploads directory or a plugin-specific directory.
• The attacker then requests the uploaded file directly via HTTP. Because the server executes PHP files stored in the web root, the uploaded PHP payload is interpreted and executed by the PHP interpreter, yielding arbitrary code execution on the web server.

Step 4: Post-Exploitation Impact

• Initial RCE: The attacker achieves arbitrary PHP code execution with the permissions of the web server user.
• Server Compromise: Further attempts may escalate to reading sensitive files (e.g., wp-config.php containing database credentials), installing web backdoors, or leveraging kernel exploits for privilege escalation to root.
• Persistence: The uploaded file persists even after plugin removal, serving as a backdoor.
• Lateral Movement & Data Exfiltration: Dump the WordPress database, steal credentials, exfiltrate customer PII, or pivot to internal network resources if the webserver is not adequately segmented.

Impact Assessment

CVSS Rationale (Score: 8.8):

The high CVSS score reflects the severity of the combined impact:

• Attack Vector: Network — attacker exploits remotely.
• Attack Complexity: Low — no need for special conditions or race conditions.
• Privileges Required: Low — contributor-level access.
• User Interaction: None — no victim interaction needed post-authentication.
• Confidentiality/Integrity/Availability Impact: High across all three — full read/write access to the filesystem and ability to disrupt hosting service.

Business Impact:

• Website Defacement — attacker can rewrite static content.
• Data Breach — database dump and exfiltration of user data.
• Malware Hosting — compromised site can serve malware to visitors.
• SEO Poisoning — injected spam content damages brand reputation and search ranking.
• Full Server Takeover — PHP RCE can lead to complete OS compromise.

Affected Systems:

WordPress installations running the Popular Posts plugin ≤ 5.3.2. Given the plugin's popularity (millions of downloads), the affected footprint is substantial. The plugin runs on shared hosting environments, managed WordPress hosts, and self-managed VPS/Dedicated servers — each with different blast radius implications.

Blast Radius:

• Direct: The single WordPress site.
• Lateral: If the hosting environment is shared (cPanel, managed WordPress), adjacent sites may be compromised.
• Supply Chain: If the compromised WordPress site distributes software or content (themes/plugins), downstream users could be impacted.

Detection Guidance

Note: Since no public exploit code is available and specific upload endpoint details are not disclosed, the following detection rules are designed around the vulnerability class (authenticated arbitrary file upload in WordPress) and the attack chain (suspicious file upload → web request to execute it).

Sigma Rule

title: WordPress Popular Posts Plugin - Suspicious File Upload (CVE-2021-42362)
id: 8f8c1f9c-1234-4f2a-9a3c-7b3f6a2e5d8c
status: experimental
description: Detects suspicious file upload requests targeting the WordPress Popular Posts plugin's image upload functionality, potentially exploiting CVE-2021-42362.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-42362
tags:
    - attack.t1190
logsource:
    category: webserver
    product: apache
detection:
    selection_path:
        cs-uri-query|contains:
            - 'popularposts'
            - 'popular-posts'
    selection_upload_ext:
        cs-uri-query|contains:
            - '.php'
            - '.phtml'
            - '.php5'
            - '.php7'
            - '.phar'
    selection_upload_method:
        cs-method: 'POST'
    selection_wp_admin:
        cs-uri-query|contains:
            - 'wp-admin'
            - 'admin-ajax.php'
    condition: selection_path and selection_upload_ext and selection_upload_method and selection_wp_admin
falsepositives:
    - Legitimate admin uploads of PHP files (rare in normal operations)
level: high

YARA Rule

rule WordPress_Popular_Posts_CVE_2021_42362
{
    meta:
        author      = "Valters IT Security"
        description = "Detects webshell/suspicious payloads uploaded via WordPress Popular Posts plugin"
        date        = "2025-04-01"
        reference   = "CVE-2021-42362"
        severity    = "high"
    strings:
        $php_tag     = "<?php"
        $short_tag   = "<?"
        $eval        = "eval(" ascii nocase
        $system      = "system(" ascii nocase
        $shell_exec  = "shell_exec(" ascii nocase
        $base64      = "base64_decode(" ascii nocase
        $passthru    = "passthru(" ascii nocase
        $assert      = "assert(" ascii nocase
    condition:
        uint16(0) == 0x8950  // PNG header
        or uint32(0) == 0xFFD8FFE0 // JPEG header
        or uint32(0) == 0xFFD8FFE0
        or uint32(0) == 0x47494638 // GIF header
        and 2 of ($php_tag, $short_tag, $eval, $system, $shell_exec, $base64, $passthru, $assert)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2021-42362 WordPress Popular Posts - Suspicious File Upload with PHP Extension"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin"; http_uri; nocase; content:"popularposts"; http_uri; nocase; content:".php"; http_uri; nocase; pcre:"/(?:php5|php7|phar|phtml|php)$/Ui"; classtype:attempted-admin; sid:4000123; rev:1; metadata:created_at 2025-04-01, updated_at 2025-04-01, mitre_tactic TA0001, mitre_technique T1190;)

alert http any any -> any any (msg:"CVE-2021-42362 WordPress Popular Posts - PHP File Uploaded and Executed"; flow:to_server,established; content:"GET"; http_method; content:"wp-content"; http_uri; nocase; content:".php"; http_uri; nocase; content:"uploads"; http_uri; nocase; pcre:"/(?:^|\/)uploads\/.+\/(.+)\.php$/Ui"; classtype:web-application-attack; sid:4000124; rev:1; metadata:created_at 2025-04-01, updated_at 2025-04-01, mitre_tactic TA0011, mitre_technique T1505;)

Elastic Detection (EQL)

// EQL query to detect requests to the Popular Posts plugin upload endpoint followed by execution of a PHP file
sequence by source.ip
    with maxspan=10m
    [ network where event.category == "web" and http.request.method == "POST"
        and http.request.uri : ("*popularposts*", "*popular-posts*", "*admin-ajax.php*") ]
    [ network where event.category == "web" and http.request.method == "GET"
        and http.request.uri : "*uploads*" and http.request.uri : "*.php*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=uri_path "(?<vuln_plugin>(?i)popularposts|(?i)popular-posts)"
| rex field=uri_path "(?<is_php>(?i)\.php)"
| eval context=lower(uri_path)
| where (like(context, "%popularposts%") OR like(context, "%popular-posts%") OR like(context, "%admin-ajax%"))
    AND (like(context, "%.php%") OR like(context, "%.phtml%") OR like(context, "%.phar%") OR like(context, "%.php5%") OR like(context, "%.php7%"))
| stats count AS requests, dc(time) AS distinct_times, values(status) AS statuses, values(clientip) AS client_ips BY uri_path, http_method
| where requests > 0
| eval is_suspicious = if(http_method=="POST" OR like(context, "%uploads%"), "HIGH_RISK", "MONITOR")
| table _time, client_ips, uri_path, http_method, requests, statuses, is_suspicious

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="100223" level="12">
        <if_sid>31151</if_sid>
        <match>POST</match>
        <regex>wp-admin|admin-ajax\.php</regex>
        <regex>popularposts|popular-posts</regex>
        <regex>\.(php|php5|php7|phar|phtml)</regex>
        <description>CVE-2021-42362: Suspicious file upload attempt targeting WordPress Popular Posts plugin (authenticated arbitrary file upload)</description>
        <mitre><id>T1190</id><technique>Exploit Public-Facing Application</technique></mitre>
        <group>web_application_attack,wordpress,authentication_failure</group>
    </rule>

    <rule id="100224" level="15">
        <if_sid>100223</if_sid>
        <match>uploads</match>
        <regex>\.(php|phar|php5|phtml)</regex>
        <description>CVE-2021-42362: PHP file accessed in uploads directory - possible webshell execution</description>
        <group>web_application_attack,compromise,wordpress</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — The patch claim originates from a single source (CNA). It is not independently confirmed by multiple vendors or security researchers.

1. Immediate Mitigations (before patching)

• Restrict User Privileges: Immediately audit and revoke contributor, author, and editor roles for any accounts that do not strictly require them. Since exploitation requires only contributor-level access, reducing the number of privileged accounts shrinks the attack surface.
• Network/Web Application Firewall: Deploy a WAF rule to block the specific attack vectors — e.g., block POST requests referencing the plugin's upload endpoint, and block execution of PHP files in wp-content/uploads/ if your WAF supports this level of control.
• Disable PHP Execution in Uploads Directory: If using Apache, place a .htaccess file in /wp-content/uploads/ blocking PHP execution (<FilesMatch "\.php$">Require all denied</FilesMatch>). On Nginx, add a location block with location ~ \.php$ { deny all; } within the uploads directory.
• Monitor Uploads Directory: Use the detection rules provided above to monitor for suspicious files appearing in the uploads directory.
• Remove/Disable the Plugin: If the plugin is not business-critical, disable and uninstall it immediately until a confirmed patch is available.

2. Patch/Upgrade Steps

• The vendor fix is to update to version 5.3.3 or newer.
• Action: Backup the WordPress site (files + database), update the plugin via the WordPress admin dashboard or by replacing the plugin folder via FTP with a freshly downloaded copy of 5.3.3+.
• Verification: After updating, confirm the plugin's version and test that image uploads still work. Check that file type validation now rejects PHP files.
• Important caveat: Because the patch is only CLAIMED (2/4 confidence), validate the patch by checking that arbitrary PHP uploads are no longer accepted. If the fix is incomplete, consider keeping the WAF rules active as a defense-in-depth measure.

3. Long-Term Hardening

• Enforce Least Privilege: Implement a role strategy where only Administrator users can upload files to server-side locations. Consider using a security plugin that restricts contributor-level users from uploading any files.
• WordPress Security Hardening: Enable automatic updates for plugins and themes. Regularly audit installed plugins and remove unused ones.
• File Integrity Monitoring (FIM): Deploy FIM on the web server to detect unexpected files appearing in web-accessible directories (e.g., /wp-content/uploads/).
• WAF Rule Persistence: Maintain the WAF rules even after patching — the attack patterns remain useful against future upload vulnerabilities.
• Credential Hygiene: Enforce strong password policy and MFA for all WordPress admin/contributor accounts to mitigate the credential-dependent attack vector.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-42362 — Official vulnerability metadata and description.
2. WordPress Popular Posts Plugin Changelog: https://wordpress.org/plugins/wordpress-popular-posts/#developers — Reference for patch version 5.3.3 release.
3. EPSS Data (FIRST.org): https://www.first.org/epss/ — EPSS score of 0.79823 (99.6 percentile) indicates active exploitation likelihood.
4. WPScan (WPVulnDB): https://wpscan.com/wordpress-plugin/wordpress-popular-posts/ — Vulnerability entry and potential remediation details (requires subscription for full details).
5. CISA KEV: Not listed — no confirmed exploitation in-the-wild documentation by CISA.

Threat Actor Campaigns: While CISA KEV does not list this CVE, the extremely high EPSS percentile (99.6%) strongly suggests automated weaponization and active scanning of targets by threat actors, consistent with known patterns of WordPress plugin vulnerability exploitation campaigns (e.g., Balada Injector and other mass-scale WordPress compromises observed in 2021–2022). No specific APT attribution has been publicly documented for this CVE.