CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Simple:Press – WordPress Forum Plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file in versions up to, and including, 6.6.0. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
Simple:Press Forum versions before 6.6.1 do not properly validate file uploads, allowing an attacker to upload malicious files without authentication. An attacker can upload executable code, take over the forum, or compromise the underlying server. This affects all installations running the vulnerable version.
What an attacker can do
Upload and execute malicious files on the server without needing a user account.
Potential impact on your site
Complete compromise of the forum and potentially the entire server hosting it.
Conditions required to exploit
Network access to the forum's upload functionality; no authentication required.
Key dates
External resources
Related vulnerabilities
