blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2019-1010209

HIGH 7.5 CVSS 3.0
Published
July 23, 2019
Last modified
June 17, 2026
NVD status
Modified
Reported by
josh@bress.net
Weakness
CWE-434
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14.

Affected products and versions

  • GoUrl.io GoURL Wordpress Plugin — Version 1.4.13 and earlier [fixed: 1.4.14]
  • gorul gourl — Up to and including 1.4.13

References

  • gist.github.com https://gist.github.com/pouyadarabi/467d3167551fb0712d3264c72db092af Patch, Third Party Advisory
  • github.com https://github.com/cryptoapi/Bitcoin-Wordpress-Plugin/blob/8aa17068d7ba31a05f66e0ab2bbb55efb0f60017/gourl.php#L5637 Patch, Third Party Advisory
  • www.youtube.com https://www.youtube.com/watch?v=K2HElM_ZYu4 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record