-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| auth0/wordpress | composer | > 5.0.0-BETA0, <= 5.3.0 | 5.4.0 |
Ongoing coverage of React2Shell
Miggo AIRoot Cause AnalysisThe vulnerability exists in the auth0/auth0-php SDK, which is a dependency of the auth0/wordpress plugin. The advisory points to a flaw in the bulk user import feature where file paths are not properly validated. The investigation started by analyzing the commit in the auth0/wordpress repository, which revealed an update to the auth0/auth0-php dependency. By comparing the versions of auth0/auth0-php before and after the update (8.16.0 and 8.17.0), a security patch was identified. The patch, in commit 9026da58f5c381cd4cb5932de829eff6eacbb65c, modifies two key files. The HttpRequest::addFile method was updated to include file validation using Assert::fileExists and Assert::readable. The Assert::fileExists method was also enhanced to reject file paths containing protocol separators like ://. This prevents an attacker from supplying a malicious path (e.g., php://filter/...) to read arbitrary files on the server during the bulk user import process. Therefore, the addFile method is the primary vulnerable function as it lacked the necessary input validation, and fileExists is a key part of the mitigation.