Description

WordPress Plugin Easy Forms for MailChimp is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Easy Forms for MailChimp version 6.0.5.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 6.1 or latest

References

https://sumofpwn.nl/advisory/2016/easy_forms_for_mailchimp_local_file_inclusion_vulnerability.html

https://packetstormsecurity.com/files/137879/WordPress-Easy-Forms-For-MailChimp-6.0.5.5-Local-File-Inclusion.html

https://wordpress.org/plugins/yikes-inc-easy-mailchimp-extender/changelog/

Related Vulnerabilities

Joomla! Core 1.6.x Multiple Cross-Site Scripting Vulnerabilities (1.6.0 - 1.6.3)

WordPress 4.6 Multiple Vulnerabilities (4.6 - 4.6)

WordPress Plugin Sucuri Security-Auditing, Malware Scanner and Security Hardening Cross-Site Scripting (1.7.15)

WordPress Plugin OneClick Chat to Order Cross-Site Scripting (1.0.4.1)

WordPress Plugin Data Tables Generator by Supsystic Security Bypass (1.10.25)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Tags

Missing Update File Inclusion