Building a website with modern tools like Nicepage is like using high-tech Lego bricks—fast, visual, and surprisingly powerful. But as with any complex system that bridges the gap between desktop design and live web servers, it has faced its share of "cracks in the foundation."
Nicepage offers a range of features that make it an attractive option for website builders. Some of its key features include:
Dependency or third-party component flaws
It boasts features like responsive design, mega menus, theme building, and over 8,000+ pre-made blocks. Its selling point is visual freedom outside the constraints of standard WordPress themes. However, that very freedom relies on complex DOM manipulations, custom shortcodes, and user-uploaded assets—all potential attack surfaces.
- Reconnaissance – The attacker scanned for
wp-content/plugins/nicepage/readme.txt to confirm version ≤ 6.3.8.
- SVG Upload without Login – Using the unauthenticated endpoint, they uploaded an SVG that renamed
wp-config.php and created a new admin user named nicepage_support.
- Template Injection – They then imported a malicious template that dropped a PHP webshell at
/wp-content/uploads/nicepage/shell.php.
- Persistence – The webshell allowed them to install a fake Nicepage update that re-opened the vulnerability even after patching.
Cons
Steps to Take
-
Overview of Nicepage Website Builder
Nicepage is a website builder that allows users to create professional-looking websites without needing to know how to code. It's designed to be user-friendly, offering drag-and-drop functionality, a variety of templates, and customization options.
Nicepage Website Builder Exploit [repack]
Building a website with modern tools like Nicepage is like using high-tech Lego bricks—fast, visual, and surprisingly powerful. But as with any complex system that bridges the gap between desktop design and live web servers, it has faced its share of "cracks in the foundation."
Nicepage offers a range of features that make it an attractive option for website builders. Some of its key features include:
Dependency or third-party component flaws
It boasts features like responsive design, mega menus, theme building, and over 8,000+ pre-made blocks. Its selling point is visual freedom outside the constraints of standard WordPress themes. However, that very freedom relies on complex DOM manipulations, custom shortcodes, and user-uploaded assets—all potential attack surfaces.
- Reconnaissance – The attacker scanned for
wp-content/plugins/nicepage/readme.txt to confirm version ≤ 6.3.8.
- SVG Upload without Login – Using the unauthenticated endpoint, they uploaded an SVG that renamed
wp-config.php and created a new admin user named nicepage_support.
- Template Injection – They then imported a malicious template that dropped a PHP webshell at
/wp-content/uploads/nicepage/shell.php.
- Persistence – The webshell allowed them to install a fake Nicepage update that re-opened the vulnerability even after patching.
Cons
Steps to Take
-
Overview of Nicepage Website Builder
Nicepage is a website builder that allows users to create professional-looking websites without needing to know how to code. It's designed to be user-friendly, offering drag-and-drop functionality, a variety of templates, and customization options.
