CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
FoxyPress versions before 0.4.2.2 do not properly validate file uploads, allowing an attacker to upload arbitrary files to the server without authentication. This can lead to remote code execution if executable files are uploaded to a web-accessible directory. Site administrators should update immediately to version 0.4.2.2 or later.
What an attacker can do
Upload arbitrary files to the server and potentially run their own code.
Potential impact on your site
Attackers can upload malicious files and execute code on your server, compromising the entire site.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
