The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/e5ef74a2-e04a-4a14-bd0e-d6910cd1c4b4 | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2023-03-13 17:15
Updated : 2024-02-28 19:51
NVD link : CVE-2023-0477
Mitre link : CVE-2023-0477
CVE.ORG link : CVE-2023-0477
JSON object : View
Products Affected
cm-wp
- auto_featured_image
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type