Description

WordPress Plugin Add From Server is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Add From Server version 3.3.3 is vulnerable; prior versions may also be affected.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

https://medium.com/@hoanhp/0-day-story-3-add-from-server-b06244c1ea6b

Related Vulnerabilities

WordPress Plugin SP Project & Document Manager Multiple Vulnerabilities (2.5.9.7)

Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.38)

WordPress Plugin AnyMind Widget Cross-Site Request Forgery (1.1)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Cross-Site Scripting (3.0.17)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Security Bypass (2.0.13)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Tags

Missing Update Directory Traversal