Description
WordPress AI Engine 插件是一个用于创建聊天机器人、生成内容和图像的AI解决方案。该插件的upload接口存在文件上传漏洞，允许未经认证的攻击者上传任意后门文件并执行恶意代码，获取服务器权限。受影响的版本为version <= 1.9.98。
WordPress AI Engine /wp-json/mwai-ui/v1/files/upload 文件上传漏洞（CVE-2023-51409）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-51409
https://github.com/RandomRobbieBF/CVE-2023-51409
https://patchstack.com/articles/ai-engine-plugin-affected-by-critical-vulnerability/
https://www.enciphers.com/exploiting-cve/ai-engine-wordpress-plugin-cve-2023-51409
https://www.rapid7.com/db/vulnerabilities/ai-engine-plugin-cve-2023-51409/
https://wpscan.com/vulnerability/15d9073d-9259-479e-af5d-9102c3a1e0e9/
https://www.cve.org/CVERecord?id=CVE-2023-51409
https://cve.imfht.com/detail/CVE-2023-51409?lang=en