CVE-2015-5681

Currently unrated

Key Information:

Vendor
Wordpress
Status
Powerplay Gallery
Vendor
CVE Published:
18 August 2015

Summary

Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.

References

http://www.openwall.com/lists/oss-security/2015/07/20/1
mailing-listx_refsource_MLIST
http://www.vapid.dhs.org/advisory.php?v=132
x_refsource_MISC
http://seclists.org/fulldisclosure/2015/Jul/64
mailing-listx_refsource_FULLDISC

EPSS Score

7% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.