I'm using Wordpress 3.9.2. As we all know, Wordpress media-upload has some restrictions - you can't upload a PHP file, cause it may be malware.

There is an app called: iCon2PHP that can merge php with jpg/png, but it doesn't work somehow - I can't open the file when uploaded - it shows the 'unloaded img' - enter image description here

I read a guide - it's here (second subsection) https://gnahackteam.wordpress.com/2012/03/02/how-to-hack-a-server-shell-uploading-rooting-defacing-covering-your-tracks/

The whole guide is outdated, but this paragraph seems to be a way to achieve the goal.

Is there any possible way to bypass it and upload a PHP through mediagallery (by converting the php, or something)?

  • 3
    Why should a normal registered user upload PHP files? As developer you have FTP. And WordPress 3.9 is outdated and probably insecure. Use the Chrome Developer Tools and take a look at the code of the img and the console.
    – user6090
    Commented Nov 14, 2015 at 11:25
  • Let's say that this is a pentest. So you say, that this is still possible to merge php with image, right?
    – Insane
    Commented Nov 14, 2015 at 13:48
  • 1
    What do you mean with merge? If you mean steganography, you might want to read information about such things like CryptoPHP. Generally you can append any content to images but this is generally malicious and insecure. Webshells are often uploaded through insecure plugins. But you can not simply bypass the core mediagallery function of WordPress. It normally reprocesses the images and removes appended codes and so on. Sure, you can misuse EXIF and other headers. If there is no vulnerability like you mean on wpvulndb.com there might not be one.
    – user6090
    Commented Nov 14, 2015 at 14:47
  • 1
    But I do not see any valid reason why you want to do this. Pentesters use tools which also test for file upload vulnerabilities. And you may have to read the sourcecode of the plugin to find possible vulnerabilities.
    – user6090
    Commented Nov 14, 2015 at 14:50
  • Yeah, just realized that there is a whole script that check's the uploaded code. I'm so stuck right now, cause I can get the admin account, but I can't do anything with it, cause permissions on theme editor/plugin editor are low and I can't edit plugin's/theme's files from the wp panel. The only 'permitted folder' is 'uploads', so I thought that I could somehow upload a PHP there and make it 'openable'. It's 3.9.2, clean, so it's totally insecure, but as we can see - permissions on files = win for the victim.
    – Insane
    Commented Nov 14, 2015 at 15:23

2 Answers 2


For default/base installs of Wordpress (with the exception of third party plugins) attacking through this vector will be a wasted effort.

The image manager is locked down pretty good at this point from non-authorized users. If the account is comprised or the upload manager is exposed publically it will still be hard to exploit it. As you can see from the source the uploader verifies mime types, checks if it's an image with getimagesize(), sanitizes file names, creates the file name with the extension hard coded based off mimetype, sets default file permissions, embedded data like EXIF information is also sanitized, and the file is re-sampled when it creates the multiple sizes. The way the upload code works you don't get any attack points to the GD image processing library either.

Aside from their protection if it has an image extension the server's mine types are not configured to pipe it through the php-cgi process. Meaning, simply running the image in a browser will not allow it to run the PHP code. You would have to have a PHP script run the code embedded in the image. You likely won't find vulnerabilities in the code base to do this for you. This is universal so you will also have difficulty with other image uploaders if they restrict php file extensions as well.

Overall you are better off finding new, undiscovered, and underestimated vectors of attack. Essentially what you want to do is the equivalent of robbing a bank by going in the front door and trying to get in through the vault door. They expected this and over the years built a pretty good vault door.


Generally you can not bypass it if there is no known vulnerability which allows this.

So far the mediagallery in WordPress does not have such a vulnerability and https://wpvulndb.com does not mention any vulnerability for the mentioned plugin.

You might find some vulnerability in the plugin using fuzzer, pentesting tools or by studying the sourcecode manually.

  • Generally you can not bypass it if there is no known vulnerability which allows this. That is exactly how vulnerabilities are found though. Bypassing security measures which were previously not known to be broken. You might want to rephrase that sentence.
    – FMaz
    Commented Feb 7, 2017 at 9:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .