WordPress CVEs

Description

The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments included in chat messages. The vulnerability was partially patched in version 3.3.3.

Affected WordPress components

• Wise Chat Plugin · wise-chat
  Confirmed match Active
  Up to and including 3.3.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• marcinlawrowski Wise Chat — Up to and including 3.3.2
• kainex wise_chat — Up to and including 3.3.3

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wise-chat/trunk/src/services/WiseChatAttachmentsService.php Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3268074/ Patch
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3288680/ Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/f70dabb4-3ae6-43cf-86e2-62ac1454b697?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record