• WordPress Plugin myGallery is prone to a remote file include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. WordPress Plugin myGallery versions 1.4b4 and prior are vulnerable; other versions may also be affected.

• Update to plugin version 1.4b5 or latest

• • http://www.securityfocus.com/bid/23702/exploit
  • https://www.exploit-db.com/exploits/3814/
  • http://www.reydes.com/d/?q=Inclusion_de_Archivo_Remoto_RFI_en_Plugin_myGallery_de_Wordpress
  • http://secunia.com/advisories/25042/

• 

• CVE-2007-2426

• CWE-94

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• Missing Update File Inclusion

• WordPress Plugin WordPress Backup and Migrate-BackupGuard Arbitrary File Upload (1.0.2)
• WordPress Plugin DP Maintenance Mode Lite Cross-Site Scripting (1.3.2)
• WordPress Plugin Arigato Autoresponder and Newsletter Cross-Site Scripting (2.3.1)
• WordPress Plugin Facebook Like Box Unspecified Vulnerability (1.0.17)
• WordPress Plugin WooCommerce Cross-Site Scripting (3.5.4)