WordPress CVEs

Description

The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 1.2.0. This is due to missing authorization checks on the `connection/{driver}/save` and `/download/single-file` REST endpoints, combined with insufficient path validation in the Google Drive `downloadFile()` function, where the Google Drive metadata `name` value is concatenated into a local path without `basename()`, `sanitize_file_name()`, or canonical path validation. This makes it possible for unauthenticated attackers to store attacker-controlled Google Drive credentials, trigger a download of an attacker-owned file whose provider-returned filename contains path traversal, and write attacker-controlled content outside the intended `downloads` directory. When the written file has a PHP extension and lands in a web-accessible location, this can lead to remote code execution.

Affected WordPress components

• Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads Plugin · cloud-storage-manager
  Confirmed match Active
  Up to and including 1.2.0
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• fluentwiz Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads — Up to and including 1.2.0

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3656663/cloud-storage-manager
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/58fd04ae-fff2-42b1-ae98-168195d84290?source=cve
• nvd.nist.gov Official NVD record