What the vulnerability does
01Description
A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patch is named e3b92b14edca6291c5f998d54c90cbe98a1fb0e3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230263.
Explanation of Vulnerability in Simple Terms
02Summary
The VaultPress plugin contains an unrestricted file upload vulnerability. An authenticated user with low privileges can upload files without proper validation, potentially allowing them to store malicious files on the site. This could lead to unauthorized access, data modification, or service disruption depending on how uploaded files are processed.
What an attacker can do
03Attacker Capabilities
Upload files to the site without proper validation or restrictions.
Potential impact on your site
04Site Impact
Malicious files could be uploaded and executed, compromising site integrity and potentially exposing sensitive data.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account on the site.
Key dates
06Disclosure timeline
June 1, 2023
CVE published
March 5, 2025
Record updated
