SiteGround Optimizer Plugin Vulnerable to Remote Code Execution

CVE-2019-25217

Summary

The SiteGround Optimizer plugin for WordPress contains a vulnerability stemming from improper access control on the switch_php function accessed through the /switch-php REST API route. This weakness permits unauthorized users to bypass security measures, thereby allowing for Remote Code Execution (RCE) and Local File Inclusion (LFI). As a result, attackers can include and execute arbitrary files on the server, potentially running malicious PHP code. This can compromise sensitive data and system integrity, as it enables the execution of code hidden within seemingly innocuous file types like images, posing significant risks to WordPress installations reliant on this plugin.

References