CVE-2013-1916 - AskarLabs CVE Database

CVE-2013-1916

Vendor N/A

Product WordPress Plugin User Photo

Weakness CWE-434 · Unrestricted file upload

Published June 24, 2022

Last update August 6, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.

Key dates

02Disclosure timeline

June 24, 2022 CVE published

August 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2013-1916 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-12775 WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2023-43740 Online Book Store Project v1.0 - Insecure File Upload CVE-2023-2888 PHPOK unrestricted upload CVE-2022-2420 URVE Web Manager uploader.php unrestricted upload CVE-2025-3593 ZHENFENG13/code-projects My-Blog-layui authorImg upload unrestricted upload