CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnail allows Upload a Web Shell to a Web Server.This issue affects WP Remote Thumbnail: from n/a through <= 1.3.2.
Explanation of Vulnerability in Simple Terms
WP Remote Thumbnail versions up to 1.3.2 allow authenticated users to upload files without proper validation. An attacker with low-level site access can upload malicious files, including PHP code, to execute arbitrary commands on the server. The vulnerability affects the entire site and any data stored on it.
What an attacker can do
Upload and execute malicious files (including PHP code) on the server.
Potential impact on your site
Complete site compromise: attackers can run code, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker must have a low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
