Remote PHP Code Execution Vulnerability in UpdraftPlus Plugin for WordPress
CVE-2017-16871

8.1HIGH

Key Information:

Vendor
Wordpress
Status
Updraftplus
Vendor
CVE Published:
17 November 2017

Summary

The UpdraftPlus plugin for WordPress, specifically versions up to and including 1.13.12, is susceptible to a remote PHP code execution flaw. This vulnerability originates from a race condition occurring in the plupload_action function located in admin.php. The issue occurs before a file linked to the 'name' parameter is deleted, allowing unauthorized users to execute arbitrary PHP code on the server. Although the vendor states that this vulnerability does not bypass a privilege boundary, it still poses a significant security risk.

References

https://github.com/LoRexxar/CVE_Request/tree/master/wordp...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.