Security Research
CVE-2024-22144 WordPress GOTMLS Plugin Code Injection: a 200k-install string concatenation bug
Thinking
2024-01-15
4 min read
Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
The WordPress GOTMLS plugin (200k+ active installs) does not parameterize user input. An attacker can run arbitrary PHP on the server through simple string concatenation.
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a4d4b6d4ade7253d06d61bf923572a6b8c253d117e8b63642be9ad8c68eaee7d4a02592bcdbd3155abcc6a953135deec61ed6729ad92ae056a76758bfc9dbe3a6985cd8e376a1e17f2301ad5bb4a1f33d62c0599c0395e8cbde263ecdda088456332913ae6cbbe5d8312287058a4519a2365eb4be02b3cd5cf5fe22e7034ae64b7dda2985025c6d4e4f9b72abbae461461290a4877ae6eb8582be60b8afaa0d12fc20a36ae2fae5e497d6c15677ed00e730bd82903572cda6b099fa2cd202ee0a7e34b09923a9ca3ce7efb7c83dac3ffa02091caca98574a93ac6aa8006b1f853638f8c058944106e87906691057710831a7f1ddc5bc75fb96850c2e8483fc1c3e089941bd8d68c73d4e83da40e4a6ae10b44691267d538bec6b910c3cfd8aa6663b8fd62afa994fb72eee3ac967fff2021af043e72bedb3a789e5f7f5f388f18df40659515296ead336079fc0f23089f4237327bdd13ffd65e983e56750396ee5e5381ec8c79a6aee0143f3a49206571f1b81d86b80f4af6f28bbfc5f8b7b4e50ba98d0335f12feaffd8077186f32732fd4c0a80d0aff35d8a3f05f7e10295771fe8db5a217d528b714298bdf544797363b97577937d7ba545df584f329460100ea8ac4dda2dafb2e803f8b452a5cd304f6fe692064e182c4e1f1890a2c39823b129d9afe24d91ed9b547c81e9dabd3518b8e1e2a790fd090b5dc964b4c6f894bb86af3bc54dbac059d4ebb4cecf4cc68aa096461a5e0a5e736edfcf37b1c2ca12d06d6084765af5f4a137e95d949b8783b36600510372f6c16b6ddda64c3f45239e52c3cf97c90b3f0e7008c9973962fb40ca1c9a1f44fe2dcaad74feea759341b57847d77470bc26d230e8abc05d9e406d96005a173e7e893671e7e43399c7e33081e75f097a8a65179b9f598a62b21231f5795b32a4a54f34e31dcb32a265ca26caff0ae961eca39c1def7bcfc4fa435a24e6ead2c46d07d8606cbcc94dd1c167c576ea841b495853ceecddb45a8d149395c22d00201223bea97c5110b645b1c8c101b2c5a54291efd95bb90497707159c3a1195cbd67ce9b76229cbd3ca5ea7fbac2f0eaf431de13a687be97413c377bcd6eea5aee54002dde1d67162f2f74373809284143c21ce475f30acdf94c3296f3fa67bd52bd0b5eabd6d88ac3266508e670406dce5141ff58e9a507a7ca9d0373d2c73aeeb58d6d664b2525e762442c450d8e0471a93f4c598140cc0fe4f22253d4fe28f966f23dbed9e0a3b4d0f97fb640c3049222024620a1d1973120f952f95933164dbbb9d09e71fa3597ad2432dca18ebf28be9e003573a9cb0b705898f695f1e90630571e55b8e3d31744e5e2c2ad8ae5752cb64a4633a281b19daf1fe015a18c24e805350d76df977dc9c8bd8ec7d64509a7384ea95723f0412b2ba995d3f50a46c3baf128c1e932857e206220437a6d81a35f08b25e593c2bfc3fede5da02013f7129980af7135aafb5565097e3067c2c1c92572891702ecff2959a0efea13ba7ff76021e9e10c6899273b398c644716b8543c9e827733957027633758a4d1314e926c864920efc07e1effaf0ab762f495a4aa3bc1d5a4741a07273e8ade74bda2c77c522a2a244ad110ba815770e47f6245b0f6bd34d998bc6d8dac3da9f649bf38c9ca77ad74b2026ccbdfee198eebf60c52809934fda4f9e08c0af84d7988ee2de977b7ced099005aa20c52b8a17f17c212a678a8ee71eb1da20cba691e06c98a126d546d112e7eaf2961ee08eb64ce70d0a4247330a19ac8e05d65012032fc165768b5c46b9aa75a0cffdbebe5aed88699d3df17d297ff250ff8f7399ab16c5136c22adfb25446ad5bc90026b50cf3bb3187231f450ad4f8dd41b23b1b451f7c5361d0a20b6b65b15b20557a6df4f9ac067e066469941ed93141f442b9ec45124812fe72df9edb569f833477cc9d99992e0daa209492d899eaff102dd73996ca6f1de385c032df5d5734a5523c0b9f1fef378940706adf6335ffcfc1eb42d3c0171313bae5ddb4a9d9759f3a8f245a99dc554fd90868ab6484a3b650476147d9193a430c6f7c94a59726140d2702234c6a83c9190263099b90dd2d9132730977990a67fdcb563aac2f6b263a9e424046439bedf9f224175e96061fdca93c3e184e4955ff7f1e3dd7089812bbbe4ab97753048b8b0dc9292eb28cbefe8f07eca39de400f1136dfd5d6c1dac312927a0504dd092f5c05c7bceaa8aaaefad840fa63787dc8da39d71d430a4d8b6ab08a3226b679c4a26889449536c7b6e9c41990a2be1eb2773a68790a355186d428e4cb3c062703b3f3760c6ab7020ffe138e2bc3d807928586c53bd5dfbb36fb45f9e38f7f5a57ee827c6f26a54777e4d9fda6921d9f9942c8bdbe75239e0ffc0eb3d5661a058f38097cc19eaadef498271dfcca5ae2b0079b493181c162a0f98edcbaddc09dac7219b7fd0c88418dc62e4710c1c8861b1db60345196c7d177f11e5a652d70d57db3366b08c87d6a0105f35a9262785ab4cba35c974e4e73af03774d7ab9b21779da2f329a710a3882b0c7b7d13d5691038f01f9738dda811ab34dde2f092a438749b6cffc6b99ed4d71c4c9ba6e5afee771e5fafb841b1b41b45bcf082584270e0a356673e4d4a6559809ac6a67c5eb2d9880145aff9d6acf5d5db4a2be424a093b73a07e02e0d4262b05694df81f3333fe159379bc0004a225c2b01986d9d0dbf05ea34621522089ec0f3660369e63797c71b2f5151a20e8b883a79e6400de0b9d880af215f615f44f15350312a75c2aaab058ceb62e5be4d4b752e5a9e64dfbf500497a7dbc575bf447d30debc9086618c6a8b4f5bb8f470495606c57883361fe16615376b4ee6365109c5047f07eb68e0af754ca6f8414dd931f87223ed27d0a7ba214f1f4e35ddd871c038a3250a1c2e720ca42c555d07eb44366dc404ad0e517a6efe3053134952a7e852d4fdc8468c4f82da48350663687aedf693a3edb29e7f22350dccc0e133d1c1f53eb9b86b850420c42c0497aa534c55692456ca3c2ee8e3d34f2a073d4032502576f19084d1001f0bf9c4aa9cc1acc86258a31e95fa308bacf3ef2b498db76633d125ee1087910c2aac4012980d53dc9779886830df02f80765b9ebd27029ad5c42d64d52bad45625ad627576d3b7fa9ddde2f73fb8aaf751ec247e2527d2328b986748804b8c697bf1151d8a60f7c6b754dd390c408328da62157d5494e6e28bdf5e692266c783da2457952a91673c98df8354f80f056bd10f64a052614ce33ae6c55624a88ba32238322616f2d9f534c9fd5870b922cf365baa3a0222ece051850e5d3174abbdb82c7313a0811c41eabb42f31d9853f99260963a9032c2756597f082d6e0af2111a8ea1051ff9adf4debdd6efbc14057178706ea1f5a51e0b0efd7ffdf4bb7d8e2f617c8a3b155c6c2ab8d7f981c45d8f59e3ace34cedd2d57dc93c15ee9f150dcddfce7067f812a3c4acc863b41a4daf39ac6bf176bb253ec45b43cfccf7fa2721648672808e914bc55dd6c3a34f0a7252813371fc54b8446c9c8673ca3b286625fcae5b3e589d8be6c55d301100e7b8e735dac5c8aef1cb63a219ff8198396ec259ebca0784b281daee50b4b119c6b63c5bdba0c6aadfd7c16e08d3612dec38e598ec19226b9b850474df95ebdf66662397dadab3265e2865f20001347976bb799f31d5c3d48d0c75767ff6e06a7a3972990d4a743d56a22da0f2b9cfa892f8209505e6bd9608760c9fa0808c9760ada7a3b7e07cd738d3b483249bf83c1ef922c12b53e7f07bcf6e830c7e36563e54b8bca16e2884452d704fc1cd355aa8ca34299fd59a69be3294d0e9fa648b6fd11fc6a24ecada6f470832733f15e40cd211b86b120fe129d583d5cf97a9602e8134c6257593ea8643fa4a00a3d6a76554ffd95277018c02322ba0265f7142389d7ddddf9550bbd38d17c04fc0ab6742ac74ed57dce4b50ef2776b791ad8ca1c296a8380be1f81cac5af9ebffb185145a9f4a405c84c9ea6d8ce10b664751fdac13e85ac76cac1e8677d8ca4ccd316dae9c6e0ce834a8f8fbe3004c403efa701d5e43b8e0d9918e3fc2a1213338ae081f21b1e05d9aa826f6ddc6d69e5125606a445819f8090294e54313b5082dad372d49df1481c911c3e01d9521f47dd0feffc2a73093a4256657b7beb20470034c71ee4045f9a6b78a1b882da1d4beef5c0bf2cd1c14fb43b08c614974a0052d8697aa112ea486d30c456bff94bcdf4149126244739212c351d734bfd9ae60dd9d3f6d1c1ab2287939248d5b18e521d2ad9cbff6459f1b659c94d9f2a928a5810b0519aaa31f7d6bedee6a7f855de05778bb7018f1bfcddddc041bd3024a0e4c9b7563390ba0ec503f5103a29f12bbf7b978fcddf11ff51398c4f37dfadfda66b3eade7e904c8e2ea84ca33cbe0275df24c5e8bc41d4013dc48402be868d4b7c6d593b0bf0f588c0355ed40bcc2dd9857133d492b46b53220f2e079999675d204bb63ffe2fba3df49dfaa8f9bab88ece04de28fb1a6cf19e3382081b7b1e690ace05bd203df9257b1e64c2f7e62a4adbc009d27ca2aa9cad5e2dd0bf74bbcebc344dd4d561bb26752d79bf28e505f4e59bd6b48bf4089ea8a7113b2d6cdc15bfbfee37879d4ac4651c931559c03fe8e05d28fb5638fb91c36322a995667450ce8d6fe558fb81887bbd14b2cfac15675b9219cfdf707f0b638e2cc28b9b8df299addd7e27948db125d391c5e45f784d810f6a5b697c0bcce9d376abdcf14a4526d10fb8406ca8b3fdcb659ac1402f35677542f761a3b6b7f6ce7b69c2d60ea2225c4194338142587f9b23ecaa57590387a3e8faa07be9644b233c94a407d4abe8aa29db54d44f155979364880f619694d6902355ac8b8a3293d0256c00143015af82effe1b730b2234a8df6c551adafefdc7ec6cdc3608caa49fd1b0ec3a17c1ed4cc60b7b76549f2ac4294dbb44965ce54977ef40eaaeaeaf9a273582cb32b1050ed2ce6bba0a72db86fb30a719334ecd30d69bd1559f822e08dda78d7afe03db253abdff305a0000920ecd76711f3485f24c549ca6ffad5d129b72c4f52f841fe69034ad0cf235cdf2cf664ab3524d9ab945b732e3b49580930c4187eb6a8eaf306ee40ad6bcc3380d9d8e34217ec7de10a58f6e4b48586c097527337f05a7d59fdcf324f7f50d47a14e567f2fdbd3d85a9ac000f985322ce1b823ad8afe4a5cc4c3464b3dbe9590bcfeaaaab11689e2d7294616a078f798a8f51c65867cc5d233d1431c8327b366ba7f1a03c23baf3fe598f6ddb975c0d3b6daf1716ae9b533c4e2c2a4e8f98cbf96dfed5dd5ad04c50e7598e158087f1d41947ae6ce7bbf50043b5c666e2245893035e6f0765d726710a7ff81c5168b7d1a63b8de3d41c312d0b1876de76e0802a6ae4e27fba7e2676a4b86e95808aa9b562018aaab116448fcd6d07d6b7d16555e4e037a0ce6f9c4bb9b732ad2005361d211b5ee87f5b121584af6772470678ebad6fe07ce1912d32844b2d11d7e3a20fc93d662b7d8bdb5cdced879f8316dfc6963e934d6db861e9cbb40980475aa4e9ea9ffd7e4780173e78ba5c0104b7fb49960608664714503e4a97489b7c8428a2d8fa76c4012b5343a45d8d75f76f42796c07f3429354af509ccdf4f350857f6ee7796814db08354c916180c5980b9144fd7cd8f076ab1efed302d3729c29c78ca348071a65eba7397a5494174412602667b8e2e9a278dfd5731c18db8b7d174d746843535257b368ce52dbf79b12717f8587071780432e126b78fa5c3b5fbf3fa3fa2d178504bc20e54ee7e3a7801a66fbfa393dc8a0655360b85981d643f832738727af37cfa16c98650ef06ffa80bd8538d5d1092357e6e1b6b11ac018c8637f3cafab7ccc57f3b50ea7f24f057d070b47cd7f0df1999125f56bbc3e8c15a53d53f27ee81d129671eda9d28b7856acba88ec128cdb5498a0327b78d717685f19d8d4ebc5e30388db39973a41db8156cfd98bae2403eb19188c241793b390ef18f788086e0691dff6ccf989701a254f6d6bcdf77d81746692a2f87e85e845d0ba03dd1e96fceb3758fbed3f9c0a18dfc76b343cbebc1b09706d03a3a2e562a476691829cc35ec829d6b45a3846f6a1b23a2f61e8910bf25ba3e4d5e584ae00c4dc43946b59f0eb467329024ad87cd69b51bb55f10178528ae35b0e38c2f2c269df839bce21b7251aefe2565b949757c2c9521a1b46ddcd31bc84bc0af0ce041425f4bb90c1e92e6f4d927d4d4a72cf5567595cf835efc281a9000f3cca8ba2c6b36adc0ede9c5a01c2cd53b8f1a6df10b95731ed5b6c9ec02a86ad6c41578da4707013e18c37230c53c71be9622b9b2fc91551f1600f3d82458570a8102bf93ac85e4eb701da54733d5c0beefabbd77c21373b819bbd319e62fbd0a658310e598a32b92597c52398b0b3913186950a951cf323a4d2d6af3d94d7df02de96504ed39e6bcffe3d2accade4bd83ef1ca59f194c9c6a735b0186b9b0a7cb3886884b5f29e11506c29bef1f8f8551897f349df0ca93d6b7754f3c95c2a294734334aaf7beb4f5f5a9672233f002d5f7ae8764a533522468cb517ba8c837558a8765e568a570ee9f950e3437070bfa6a17ec202e323caaa55cceca455fc555c0a1f962a1d44d441bfb05380f24a1df8686251ccdef39a52b4370fa39720959e7050bbc95b748ff60a7e809f1a80b1bb76c94786a9ee51f675e97a2ae71621e51066f1e57a2da04bf48206ce938298f2b5bd64172a36caad2f0419dde9c3b8cb7e234948e606fb9ae8ae465b00f93ba09fb525908c3322cecb900deae3386ebc2583d78f0accae67ade74d3da0e4ee742b262ce887f6952ca4bc0699a26223b1bd2ea66745a750cf6ab9fa980750a5c453dcf6d09a9122295e3db5b0416259e2de67d4c6ba9af9819a19ecb675ec36a4f9549be7e0718d0e019f2edd6b79d3d364637eeb0f6277f72ac79aa20d7062d1ddc016e174e2a45c7acc3a0bdff1a3ea96c12f561ad6ad0aeda82692822fa173db0879a7356352e376d6d6e6139602c05c49d2f882cb1bd718ecc59152fc968621e084f747094a9db3af4f4273d2d0f1bbf62dd7e4e5b994cff2c6bb0ca1896f474cb6419c9d87cd14681485c5097a2764dfb211d0f78b71f7890049f74f041faa2fd1a4f732209839891edc6ba9f08c99a8f99c9d96bd62370b14f9a782909b160a6dd5eca29d1bfc00fa933e2650c9418e1f2b91fe3ac165a15a31ce83d4328937ee8e940dc852d247ba2e9883ee61390a1d5fe406fec51f72c9d8f07e46b8f0d1d8130f19217006f3cfadbcdee1fd60d50a849dd32459eb57ccc27c8a4f64a4633495eab87ed394254b3c2c37e2d44a3b9202fd142fae223bc8c5bdc8707c744b483bfe7006ecb3e09afc0b3e9c6762d4b4cc294d46a9b0489c7a5b89f727865a130359c8d323901e2a5d5dd93e50797198a0b567724a6f9cb904639419ea7223bc9ce459e6472932150a40c7e5cd85e88211f8b4daf882ced76fb7d044b27834e6405ee8d2d9533ed9ccfa842231bf5acae2120b6d92fafe3bf827bcf2b0331bf92e45d58490e519934594dc1c1cd14ddceea44aad035c96779a92af789caefadb9d6194cab061c1534f34b57d3e1007f97cb430238201c90b7174bd25eae66edf589209a9b7191db3b630d3d6637e78e1b5bf6a5caf770cb87557e7f7171a7997cf0ad2ffa338945e7fb39b5a5f88897096765f316149e14d981bfa81813e9673b4d80083be9a835e9ab8917eee72562ea226c773e28baeffe4a25482871012c4114e2651ba4ad42dcbe936d95751bcb7a8283cbe7a24bfe697655c1c2c095b2e439b96dbfbeb988092f463f67f5c3903582d9fe59f8df2387f39fe2570a50d45578275deeb9afceb9e36129fb9547696c9b1256f0eec837780ea22f69aa15b43dc16fdc683a82f1af6dc4154f1351d54fd3b0312c7a83d1f426c9ab6dc83c51e81ef62f868f463e2c12c811b0759c0fa372afddc097b8cf1999db21c3a8a263e2aea3b4300c1c3da2ee850bad1f8de22b8b96ecf5cb3d8c91faaa4f0ae6a719c09219ccf3