CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in SuitePlugins Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member allows Upload a Web Shell to a Web Server.This issue affects Video & Photo Gallery for Ultimate Member: from n/a through <= 1.1.0.
Explanation of Vulnerability in Simple Terms
Video & Photo Gallery for Ultimate Member allows authenticated users to upload files without proper validation, enabling them to upload malicious code to the site. An attacker with a low-privilege account can execute arbitrary PHP code, read sensitive data, modify site content, and disrupt service. The vulnerability affects all versions up to 1.1.0 and impacts the entire site due to scope change.
What an attacker can do
Upload and execute malicious code on the site, read sensitive files, modify content, and crash the site.
Potential impact on your site
Complete site compromise possible; attacker can steal data, deface content, inject malware, or take the site offline.
Conditions required to exploit
Attacker needs a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
