Description
WordPress Plugin Kish Guest Posting is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. WordPress Plugin Kish Guest Posting version 1.2 is vulnerable; other versions may also be affected.
Remediation
Restrict access to wp-content/plugins/kish-guest-posting/uploadify/scripts/uploadify.php (e.g. via .htaccess) or disable the plugin until a fix is available
References
http://www.securityfocus.com/bid/51638/exploit
http://www.exploit-db.com/exploits/18412/
http://packetstormsecurity.com/files/109015/wpkishguestposting-shell.txt
Related Vulnerabilities
MySQL CVE-2016-0600 Vulnerability (CVE-2016-0600)
WordPress Plugin Quick Page/Post Redirect Cross-Site Request Forgery (5.0.4)
phpMyAdmin Improper Input Validation Vulnerability (CVE-2008-4096)
PHP Out-of-bounds Read Vulnerability (CVE-2017-9227)
WordPress Plugin Widget Settings Importer/Exporter Cross-Site Scripting (1.5.3)