CVE-2018-15877: WordPress Plainview Activity Monitor Plugin OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw allows authenticated remote OS command execution with public exploit code and a very high EPSS score, though it requires a low-privileged account and is not known to be exploited in the wild per KEV.

What it is

The Plainview Activity Monitor plugin before 20180826 for WordPress passes the ip parameter of an admin.php?page=plainview_activity_monitor&tab=activity_tools request to a shell without sanitizing shell metacharacters, allowing OS command injection. Because the vulnerable code runs in the web server context, successful injection gives command execution on the host, which is far more severe than typical WordPress plugin flaws.

Impact

An attacker with a low-privileged authenticated account can execute arbitrary operating system commands on the WordPress server, leading to full compromise of the host and any data or credentials it can reach.

Attack surface

Reached over the network through the WordPress admin interface at wp-admin/admin.php with the plainview_activity_monitor page and activity_tools tab; the CVSS vector (PR:L) indicates a low-privileged authenticated user is required, with no user interaction.

Exploitation

Public exploit code is available (Exploit-DB 45274, Packet Storm, and a GitHub PoC), and EPSS is 0.7699 (99.5th percentile), indicating a high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Update the Plainview Activity Monitor plugin to version 20180826 or later, or remove the plugin if it is no longer maintained.
• If patching is not immediately possible, deactivate the plugin or restrict access to wp-admin to trusted networks and accounts.
• Audit WordPress user accounts and remove or downgrade unnecessary low-privileged users who can reach the plugin's admin pages.
• Apply least privilege to the web server process and use a WAF rule to block shell metacharacters in the ip parameter of the activity_tools request.

Detection

• Monitor web server and WordPress logs for requests to admin.php with page=plainview_activity_monitor and tab=activity_tools containing shell metacharacters (;, |, &, $(), backticks) in the ip parameter.
• Alert on unexpected child processes spawned by the web server user (for example sh, bash, curl, wget, nc) using process auditing or EDR.
• Review outbound network connections and file writes originating from the web server process for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.