Description
WordPress Plugin Child Theme Creator by Orbisius is prone to an arbitrary file modification vulnerability because it fails to properly verify user-supplied input. An attacker can exploit this vulnerability to modify local files in the context of the web server process, which may result in privilege escalation; other attacks are also possible. WordPress Plugin Child Theme Creator by Orbisius version 1.2.6 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.2.8 or latest
References
http://cinu.pl/research/wp-plugins/mail_28c91eee00e8e4b5868ebc58b5b1f730.html
https://wordpress.org/plugins/orbisius-child-theme-creator/changelog/
Related Vulnerabilities
WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Scripting (1.9.11)
OpenSSL CVE-2023-5363 Vulnerability (CVE-2023-5363)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-21650)
Squid Improper Input Validation Vulnerability (CVE-2016-2571)
WordPress Plugin SAML SP Single Sign On-SSO login Cross-Site Scripting (4.8.83)