Unrestricted File Upload in Simple Ads Manager Plugin for WordPress

CVE-2015-2825

Summary

The Simple Ads Manager plugin for WordPress prior to version 2.5.96 has a significant vulnerability due to unrestricted file uploads. This flaw allows remote attackers to upload files with executable extensions through the sam-ajax-admin.php script. Once the malicious file is uploaded, an attacker can easily execute arbitrary code by directly accessing the uploaded file via a crafted request, leading to potential compromise of the affected WordPress site.

References