CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through <= 1.0.1.
Explanation of Vulnerability in Simple Terms
WP donimedia carousel versions 1.0.1 and earlier allow authenticated users to upload files without restriction. An attacker with low-level site access can upload malicious files—including PHP scripts—to execute code on the server. This affects all site data and functionality. Update to a version newer than 1.0.1 immediately.
What an attacker can do
Upload and execute malicious files (including PHP code) on the server with full site access.
Potential impact on your site
Any user with basic site access can compromise the entire site, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker needs a low-privilege user account (subscriber or contributor level) on the WordPress site.
Key dates
External resources
Related vulnerabilities
