Description

WordPress Plugin Post Grid is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to delete arbitrary files in the context of the webserver process. WordPress Plugin Post Grid version 2.0.12 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.0.13 or latest

References

https://www.pluginvulnerabilities.com/2016/11/08/file-deletion-vulnerability-in-post-grid/

https://wordpress.org/plugins/post-grid/changelog/

Related Vulnerabilities

WordPress Plugin Zingiri Web Shop 'ajax_save_name.php' Remote Code Execution (2.2.3)

Oracle JRE CVE-2020-14581 Vulnerability (CVE-2020-14581)

Apache Tomcat Other Vulnerability (CVE-2002-0682)

WordPress Plugin WP-Filebase Download Manager Multiple Unspecified Vulnerabilities (0.2.9.24)

Oracle Application Server CVE-2009-1009 Vulnerability (CVE-2009-1009)

Severity

High

Classification

CWE-73 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update