CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Explanation of Vulnerability in Simple Terms
WordPress Popular Posts plugin versions up to 5.3.2 do not properly validate file uploads, allowing authenticated users to upload arbitrary files to the site. An attacker with a low-privilege account (such as a contributor or subscriber) can upload malicious files, including PHP scripts, to execute code on the server. This affects sites where user registration or guest uploads are enabled.
What an attacker can do
Upload and execute arbitrary files, including PHP code, on the site server.
Potential impact on your site
Attackers can run malicious code on your site, steal data, modify content, or take full control of the WordPress installation.
Conditions required to exploit
Attacker needs a low-privilege WordPress account (contributor or subscriber level); no user interaction required.
Key dates
External resources
Related vulnerabilities
