CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
The Thumbnail Carousel Slider plugin allows authenticated users with low privileges to upload files without restriction. An attacker can upload malicious files—including executable code—to compromise the site. All versions before 1.0.1 are affected. Update immediately to version 1.0.1 or later.
What an attacker can do
Upload malicious files, including executable code, to the site.
Potential impact on your site
Site can be fully compromised; attacker gains ability to read, modify, or delete data and disrupt service.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., contributor or subscriber role).
Key dates
External resources
Related vulnerabilities
