|
Description
|
|
A vulnerability has been discovered in the Omni Secure Files plugin for WordPress, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/omni-secure-files/plupload/examples/upload.php script improperly verifying uploaded files. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in version 0.1.13. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
WordPress Omni Secure Files Plugin 0.x
|
|
|
|
|
|
Solution
|
|
Restrict access to the wp-content/plugins/omni-secure-files/plupload/examples/upload.php script (e.g. via .htaccess).
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
http://www.exploit-db.com/exploits/19009/
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
