WordPress Zingiri Web Shop Plugin Arbitrary File Upload Vulnerability
Description
Sammy Forgit has discovered a vulnerability in the Zingiri Web Shop plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/zingiri-web-shop/fwkfor/ajax/uploadfilexd.php script allowing to upload files to a folder inside the webroot. This can be exploited to e.g. execute arbitrary PHP code by uploading a malicious PHP script.
The vulnerability is confirmed in version 2.4.3. Other versions may also be affected.
Vulnerable Products
Vulnerable Software: WordPress Zingiri Web Shop Plugin 2.x
