CVE-2011-5051

Currently unrated

Key Information:

Vendor
Wordpress
Status
WP Symposium
Vendor
CVE Published:
4 January 2012

Summary

Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.

References

http://osvdb.org/78041
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/46097
third-party-advisoryx_refsource_SECUNIA
https://wpsymposium-trac.sourcerepo.com/wpsymposium_trac/...
x_refsource_CONFIRM

EPSS Score

9% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.