CVE-2012-1011 in AllWebMenus plugin
Summary
by MITRE
actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/08/2025
The vulnerability identified as CVE-2012-1011 resides within the AllWebMenus plugin version 1.1.8 for WordPress, representing a critical access control flaw that enables remote attackers to circumvent intended security restrictions. This weakness specifically targets the plugin's actions.php file which governs various administrative functions and file handling operations. The vulnerability operates through a sophisticated bypass mechanism that exploits the plugin's reliance on HTTP_REFERER validation for access control decisions, creating a dangerous pathway for unauthorized code execution.
The technical implementation of this vulnerability leverages a multi-stage attack vector that begins with manipulating the HTTP_REFERER header to a predetermined value that the plugin accepts as legitimate. This initial step exploits a flawed validation logic where the plugin fails to properly verify the authenticity of the requesting source, instead relying on a potentially manipulable HTTP header field. The attack continues with the upload of a ZIP archive containing malicious PHP code, which the vulnerable plugin processes without adequate sanitization or security checks. The final stage involves direct access to the uploaded PHP file through a URL request, allowing execution of arbitrary code with the privileges of the web server.
The operational impact of this vulnerability extends beyond simple code execution, as it provides attackers with complete control over the affected WordPress installation. The ability to upload and execute arbitrary PHP code means that threat actors can establish persistent backdoors, exfiltrate sensitive data, modify website content, or use the compromised system as a launch point for further attacks within the network. This vulnerability directly violates the principle of least privilege and represents a classic example of a privilege escalation vulnerability that can be exploited remotely without authentication. The unspecified directory access pattern suggests that the vulnerability may affect multiple locations within the web server's file system, potentially allowing attackers to place malicious files in critical system directories.
Security professionals should recognize this vulnerability as a manifestation of CWE-285, which addresses improper authorization issues, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter. The flaw demonstrates poor input validation and insufficient access control mechanisms, common patterns in web application security vulnerabilities. Organizations should immediately implement mitigations including disabling the vulnerable plugin, applying the latest security patches, and implementing network-level restrictions to prevent unauthorized file uploads. Additionally, monitoring for suspicious HTTP_REFERER headers and unusual file upload patterns should be implemented as part of defensive measures against this specific attack vector. The vulnerability underscores the critical importance of proper access control implementation and the dangers of relying on HTTP headers for security decisions, as these can be easily manipulated by attackers.