CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
Doccure Core versions up to 1.5.3 contain an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files to the server. An attacker can exploit this to upload malicious files, including executable code, without any authentication or user interaction. This can lead to complete compromise of the affected site.
What an attacker can do
Upload arbitrary files, including executable code, to the server without authentication.
Potential impact on your site
An attacker can upload malicious files and execute code on your server, potentially compromising your entire site and data.
Conditions required to exploit
Network access to the vulnerable Doccure Core installation; no authentication required.
Key dates
External resources
Related vulnerabilities
