|
Description
|
|
A vulnerability has been discovered in the Front End Upload plugin for WordPress, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the wp-content/plugins/front-end-upload/upload.php script allowing the upload of files with arbitrary extensions to a folder inside the webroot. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script.
Successful exploitation requires that the plugin is installed and deactivated.
The vulnerability is confirmed in version 0.5.3. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
WordPress Front End Upload Plugin 0.x
|
|
|
|
|
|
Solution
|
|
Update to version 0.5.4.4.
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
Front End Upload:
http://wordpress.org/extend/plugins/front-end-upload/changelog/
Adrien Thierry:
http://www.exploit-db.com/exploits/19008/
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
