CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.
Explanation of Vulnerability in Simple Terms
The WP-Property WordPress plugin versions 1.35.0 and earlier allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files to the site, potentially including PHP code that executes on the server. This vulnerability requires no authentication or user interaction and can be exploited over the network.
What an attacker can do
Upload arbitrary files, including PHP code, to the site without authentication.
Potential impact on your site
Attackers can upload and execute malicious code on your site, leading to full compromise.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
