WordPress CVEs

Description

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected WordPress components

• IMGspider – 图片采集抓取插件 Plugin · imgspider
  Confirmed match Active
  Up to and including 2.3.10; Before 2.3.11
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• wbolt IMGspider – 图片采集抓取插件 — Up to and including 2.3.10
• wbolt imgspider — Up to and including 2.3.10
• wbolt imgspider — Before 2.3.11

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.class.php#L122 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3107741/imgspider Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91e-e396643a8129?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record