WordPress CVEs

Description

Unrestricted file upload vulnerability in admin/scripts/FileUploader/php.php in the ReFlex Gallery plugin before 3.1.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in uploads/ directory.

Affected WordPress components

• ReFlex Gallery » WordPress Photo Gallery Plugin · reflex-gallery
  Confirmed match Abandoned
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• reflex_gallery_project reflex_gallery — Up to and including 3.1.3

References

• osvdb.org http://osvdb.org/show/osvdb/88853
• packetstormsecurity.com http://packetstormsecurity.com/files/130845/ Exploit
• packetstormsecurity.com http://packetstormsecurity.com/files/131515/ Exploit
• www.securityfocus.com http://www.securityfocus.com/bid/57100
• wordpress.org https://wordpress.org/plugins/reflex-gallery/changelog/ Patch
• wpvulndb.com https://wpvulndb.com/vulnerabilities/7867
• www.exploit-db.com https://www.exploit-db.com/exploits/36809/ Exploit
• nvd.nist.gov Official NVD record