|
Description
|
|
A vulnerability has been reported in the Highlight - Powerful Premium theme for WordPress, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to the /wp-content/themes/highlight/lib/utils/upload-handler.php script improperly validating the extension of an uploaded file. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
Successful exploitation requires the "Contributor" role.
Note: This can also be exploited via cross-site request forgery attacks.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
WordPress Highlight - Powerful Premium Theme 1.x
|
|
|
|
|
|
Solution
|
|
Update to a fixed version (please contact the vendor for details).
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
http://packetstormsecurity.com/files/123974/wphighlightpremium-shellxsrf.txt
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
