CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.
Explanation of Vulnerability in Simple Terms
The Multiple Page Generator plugin for WordPress contains an unrestricted file upload vulnerability affecting versions up to 3.4.0. An authenticated administrator can upload arbitrary files to the server, potentially including PHP scripts. This allows an attacker with admin privileges to execute code on the site and compromise it completely. Update to a version newer than 3.4.0.
What an attacker can do
Upload arbitrary files, including PHP scripts, to execute code on the site.
Potential impact on your site
A compromised admin account can lead to full site takeover, data theft, and malware installation.
Conditions required to exploit
Attacker must have WordPress administrator privileges.
Key dates
External resources
Related vulnerabilities
