CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in pushassist Push Notifications for WordPress by PushAssist push-notification-for-wp-by-pushassist allows Upload a Web Shell to a Web Server.This issue affects Push Notifications for WordPress by PushAssist: from n/a through <= 3.0.8.
Explanation of Vulnerability in Simple Terms
The PushAssist WordPress plugin versions 3.0.8 and earlier allow authenticated users to upload files without proper validation. An attacker with a low-privilege account can upload malicious files to the server, potentially gaining control of the site. The vulnerability affects all aspects of site security and data integrity.
What an attacker can do
Upload malicious files to the server and execute code on the site.
Potential impact on your site
Site could be fully compromised; attacker can read, modify, or delete all data and user accounts.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
