Description

WordPress Plugin Eventify-Simple Events is prone to a remote file include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. WordPress Plugin Eventify-Simple Events version 1.7.g is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.7.h or latest

References

http://plugins.trac.wordpress.org/changeset/441308/eventify/trunk/php/ajax/fetcheventdetails.php?old=434868&old_path=eventify%2Ftrunk%2Fphp%2Fajax%2Ffetcheventdetails.php

http://secunia.com/advisories/46345

Related Vulnerabilities

WordPress Plugin OptionTree PHP Object Injection (2.6.0)

WordPress Plugin Custom Contact Forms Security Bypass (5.1.0.3)

WordPress Plugin Taxonomy Converter Unspecified Vulnerability (1.1)

WordPress Plugin Direct Download for Woocommerce Arbitrary File Download (1.15)

WordPress Plugin WP Statistics Multiple Cross-Site Scripting Vulnerabilities (2.2.4)

Severity

High

Classification

CWE-94 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update File Inclusion