CVE-2018-7422

What it actually does

The vulnerability permits unauthenticated remote file retrieval by supplying an arbitrary absolute path in the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, resulting in direct disclosure of any readable local file contents.

Why it matters to the business

Attackers can obtain configuration files, credentials, or source code from affected WordPress sites, enabling further compromise and potential data breaches across any organization using the vulnerable plugin.

How an attack unfolds

An attacker issues a crafted HTTP GET request to the exposed ajax_shortcode_pattern.php endpoint, setting the ajax_path parameter to a traversal sequence that resolves to a target file such as wp-config.php; the server includes and returns the file contents without authentication or sanitization.

How to fix it

Immediately remove or disable the Site Editor plugin; replace it with a maintained alternative. Monitor the plugin author's site for any future security updates and apply them promptly if the plugin is reintroduced.

How to confirm the fix worked

Inspect the plugin directory for the presence of editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php; attempt a controlled request with a known-readable file path and confirm whether its contents are returned in the response.

Typical attack path

1. Identify a WordPress site running the Site Editor plugin version <= 1.1.1
2. Locate the ajax_shortcode_pattern.php endpoint via directory enumeration or known plugin paths
3. Craft a request supplying an absolute or traversal-based file path in the ajax_path parameter
4. Retrieve and exfiltrate sensitive file contents for credential harvesting or further attack staging

How to detect it

Search web server access logs for requests to ajax_shortcode_pattern.php that contain the ajax_path parameter with absolute paths, traversal sequences, or references to common sensitive files such as wp-config.php.

• ajax_shortcode_pattern.php?ajax_path=
• /editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php
• ajax_path=../../../../
• ajax_path=/etc/passwd

What your security team should do

• Audit all WordPress instances for the Site Editor plugin and remove it where present
• Block access to ajax_shortcode_pattern.php via web application firewall rules until removal is complete
• Review web server access logs for requests containing ajax_path with path traversal patterns
• Scan for exposed configuration files or credential leaks that may have resulted from prior exploitation