Arbitrary File Upload Vulnerability in Crelly Slider Plugin for WordPress
CVE-2019-15866

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Crelly Slider
Vendor
CVE Published:
3 September 2019

Summary

The Crelly Slider plugin for WordPress, prior to version 1.3.5, is susceptible to an arbitrary file upload vulnerability, allowing attackers to upload PHP files via a ZIP archive to the wp_ajax_crellyslider_importSlider endpoint. This security issue could lead to unauthorized code execution and potential control over the web application. Implementing proper input validation and timely updates is essential to mitigate this risk.

References

https://wordpress.org/plugins/crelly-slider/#developers
x_refsource_MISC
https://blog.nintechnet.com/arbitrary-file-upload-vulnera...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.