WordPress CVEs

Description

The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This same function can also be used to execute arbitrary PHP code.

Affected WordPress components

• Subscribe to Comments Plugin · subscribe-to-comments
  Confirmed match Active
  Up to and including 2.1.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• markjaquith Subscribe to Comments — Up to and including 2.1.2
• markjaquith subscribe_to_comments — Up to and including 2.1.2

References

• advisories.dxw.com https://advisories.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2/ Exploit, Third Party Advisory
• packetstormsecurity.com https://packetstormsecurity.com/files/132694/ Exploit, Third Party Advisory
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1198281%40subscribe-to-comments&new=1198281%40subscribe-to-comments&sfp_email=&sfph_mail= Product, Release Notes
• seclists.org https://seclists.org/fulldisclosure/2015/Jul/71 Exploit, Mailing List
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/f92784a7-f2b3-47f8-b03f-4e234b57e40a?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record