CVE-2023-54352: WordPress Seotheme Remote Code Execution Unauthenticated
WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/seothemefrom your environment.Uninstall and remove the 'seotheme' WordPress theme from the site if it is not required. Remove its files from /wp-content/themes/seotheme.
- Configuration
Remove write permissions for the webserver user on /wp-content/themes/seotheme so attackers cannot upload files. Adjust ownership and filesystem permissions (e.g., chown/chmod) to prevent uploads.
WordPress theme directory (/wp-content/themes/seotheme) webserver write permissions = remove webserver write access (make directory non-writable) - Configuration
Configure the web server (or use .htaccess for Apache) to disable PHP execution in /wp-content/themes/seotheme (deny or return 403/404 for requests to .php files in that directory).
Web server / PHP execution for theme directory php_execution = disabled for /wp-content/themes/seotheme - Compensating control
Block or restrict HTTP access to /wp-content/themes/seotheme/mar.php (and other suspicious files) at the webserver, WAF, or firewall level to prevent access to uploaded shells.
- Operational
Search the filesystem and website for /wp-content/themes/seotheme/mar.php and other malicious uploads; remove any discovered shells, restore affected files from a known-good backup, and review access logs for unauthorized activity. If system compromise is suspected, perform a full site/server remediation or rebuild.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54352?
CVE-2023-54352 has a critical severity score of 9.8.
How do I fix CVE-2023-54352?
To fix CVE-2023-54352, update the WordPress Seotheme to the latest version that addresses this vulnerability.
What is the impact of CVE-2023-54352?
CVE-2023-54352 allows unauthenticated attackers to execute arbitrary PHP code, leading to potential system command execution.
Who is affected by CVE-2023-54352?
Any user or site utilizing the WordPress Seotheme is affected by CVE-2023-54352.
What are the exploitation methods for CVE-2023-54352?
CVE-2023-54352 can be exploited by uploading malicious PHP files to the Seotheme directory.