Description

WordPress Plugin Ad Manager by WD-Advanced Ad Manager is prone to multiple vulnerabilities, including arbitrary file deletion and arbitrary file download vulnerabilities. An attacker can exploit these vulnerabilities to delete arbitrary files or to gain access to sensitive information, which may aid in launching further attacks. WordPress Plugin Ad Manager by WD-Advanced Ad Manager version 1.0.11 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.0.13 or latest

References

https://www.exploit-db.com/exploits/46252

https://www.pluginvulnerabilities.com/2019/01/28/arbitrary-file-deletion-vulnerability-in-ad-manager-by-wd/

https://packetstormsecurity.com/files/151371/WordPress-Ad-Manager-WD-1.0.11-Arbitrary-File-Download.html

https://plugins.svn.wordpress.org/ad-manager-wd/trunk/readme.txt

Related Vulnerabilities

Squid Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-4115)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2024-24213)

WordPress Plugin WP-VR-view-Add Photo Sphere, 360 video to WordPress Cross-Site Scripting (1.6)

Oracle JRE CVE-2013-2444 Vulnerability (CVE-2013-2444)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-20279)

Severity

High

Classification

CWE-73 CWE-538 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update