CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
Explanation of Vulnerability in Simple Terms
Iptanus File Upload versions 4.24.11 and earlier contain a path traversal vulnerability that allows an attacker to write files outside the intended upload directory. An unauthenticated attacker can exploit this over the network without user interaction to upload malicious files to arbitrary locations on the server, potentially overwriting critical files or achieving code execution.
What an attacker can do
Upload files to arbitrary locations on the server, overwriting existing files or placing malicious code.
Potential impact on your site
An attacker can write files anywhere on your server, potentially compromising the entire site or underlying system.
Conditions required to exploit
Network access to the vulnerable upload endpoint; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
