Description

WordPress Plugin Cimy User Extra Fields is prone to a Denial of Service vulnerability. Exploiting this issue allows an attacker to delete random server files and 'hide' multiple files on the server, thus denying service to legitimate users. WordPress Plugin Cimy User Extra Fields version 2.6.3 is vulnerable; prior versions are also affected.

Remediation

Update to plugin version 2.6.4 or latest

References

http://www.marcocimmino.net/cimy-wordpress-plugins/cimy-user-extra-fields/all-versions-and-changelog/

Related Vulnerabilities

Dotclear Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2014-3783)

MySQL CVE-2023-22115 Vulnerability (CVE-2023-22115)

WordPress Plugin No Page Comment Multiple Vulnerabilities (1.1)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-47795)

XWiki Improper Encoding or Escaping of Output Vulnerability (CVE-2022-41934)

Severity

High

Classification

CWE-400 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Denial Of Service