Arbitrary File Upload Vulnerability in Users Ultra Plugin for WordPress
CVE-2015-9402

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Users Ultra Membership
Vendor
CVE Published:
20 September 2019

Summary

The Users Ultra plugin for WordPress, prior to version 1.5.59, contains a vulnerability that allows for arbitrary file uploads through the 'uultra-form-cvs-form-conf' feature. This weakness can enable attackers to upload malicious files to the server, potentially leading to various security risks, including unauthorized access, data breach, or even complete takeover of the affected site. Website owners using this plugin are urged to update to the latest version to mitigate associated security risks.

References

https://wpvulndb.com/vulnerabilities/8243
x_refsource_MISC
https://wordpress.org/plugins/users-ultra/#developers
x_refsource_MISC
https://seclists.org/bugtraq/2015/Nov/93
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.