Description (CNA)
The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wbolt / IMGspider – 图片采集抓取插件 | affected 0 through 2.3.10 |
CWE
CWE-434
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91e-e396643a8129?source=cve
- https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L122
- https://plugins.trac.wordpress.org/changeset/3107741/imgspider
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.