CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The OS DataHub Maps plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'OS_DataHub_Maps_Admin::add_file_and_ext' function in all versions up to, and including, 1.8.3. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Explanation of Vulnerability in Simple Terms
OS DataHub Maps versions 1.8.3 and earlier allow authenticated users to upload files without proper validation. An attacker with low-level access can upload malicious files to the server, potentially gaining the ability to run code, modify data, or disrupt service. All versions up to 1.8.3 are affected.
What an attacker can do
Upload malicious files to the server and execute code, modify data, or crash the application.
Potential impact on your site
Any authenticated user can upload and execute arbitrary files, compromising confidentiality, integrity, and availability of the entire system.
Conditions required to exploit
Attacker must have a low-privilege user account on the system.
Key dates
External resources
Related vulnerabilities
