CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the upload.php endpoint. Attackers can upload files with arbitrary extensions by manipulating the 'name' parameter to execute code from the uploads directory.
Explanation of Vulnerability in Simple Terms
Peugeot Music version 1.0 contains a missing authentication vulnerability that allows unauthenticated network access to sensitive functionality. An attacker can exploit this without user interaction or special privileges. The vulnerability affects confidentiality, integrity, and availability of the affected system.
What an attacker can do
Access sensitive functionality without authentication or credentials.
Potential impact on your site
Attackers can read, modify, or disrupt the music plugin and potentially the site without logging in.
Conditions required to exploit
Network access to the affected Peugeot Music installation; no authentication required.
Key dates
External resources
Related vulnerabilities
