Unauthorized File Upload in Mobile Friendly App Builder Plugin by EasyTouch
CVE-2017-1002000

9.8CRITICAL

Key Information:

Vendor

Wordpress
Status
Mobile-friendly-app-builder-by-easytouch
Vendor
CVE Published:
14 September 2017

What is CVE-2017-1002000?

The Mobile Friendly App Builder by EasyTouch version 3.0 has a vulnerability that allows unauthorized users to upload files without proper authentication or permissions. This flaw lies in the handling of file uploads in the server/images.php file, posing a significant risk to WordPress installations using this plugin. By exploiting this vulnerability, attackers can potentially upload malicious content, leading to further compromises of the affected site.

Affected Version(s)

mobile-friendly-app-builder-by-easytouch < 3.0

References

http://www.securityfocus.com/bid/96905
vdb-entryx_refsource_BID
http://www.securityfocus.com/bid/96899
vdb-entryx_refsource_BID
https://wordpress.org/plugins-wp/mobile-friendly-app-buil...
x_refsource_MISC

EPSS Score

69% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-1002000 : Unauthorized File Upload in Mobile Friendly App Builder Plugin by EasyTouch