WordPress CVEs

Description

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server.

Affected WordPress components

• Iptanus File Upload Plugin · wp-file-upload
  Confirmed match Active
  Up to and including 4.24.15
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• nickboss Iptanus File Upload — Up to and including 4.24.15
• iptanus wordpress_file_upload — Before 4.25.0

References

• abrahack.com https://abrahack.com/posts/wp-file-upload-rce-part2/
• plugins.svn.wordpress.org https://plugins.svn.wordpress.org/wp-file-upload/trunk/wfu_file_downloader.php Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3217005/ Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/31052fe6-a0ae-4502-b2d2-dbc3b3bf672f?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record