CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and excluding, 2.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
Droip versions before 2.5.2 do not properly validate file uploads, allowing authenticated users to upload arbitrary files to the server. An attacker with low-level access can upload malicious files, potentially including executable code, to compromise the application and underlying system. This vulnerability requires valid user credentials but no additional user interaction.
What an attacker can do
Upload arbitrary files, including executable code, to the server.
Potential impact on your site
Attackers with user accounts can upload malicious files and run code on your server, leading to full system compromise.
Conditions required to exploit
Valid user account with low-level privileges; network access to the application.
Key dates
External resources
Related vulnerabilities
