Description

WordPress Plugin Simple Ads Manager is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Simple Ads Manager version 2.10.0.130 is vulnerable; prior versions may also be affected.

Remediation

Edit the source code to ensure that input is properly verified or disable the plugin until a fix is available

References

https://www.pluginvulnerabilities.com/2016/10/28/local-file-inclusion-lfi-vulnerability-in-simple-ads-manager/

http://portfob.ru/security-time/0day-exploit-for-wordpress-plugins-simple-ads-manager-sam-pro-lite-sam-pro-free-edition/

Related Vulnerabilities

WordPress Plugin Smart Slider 2 Multiple Cross-Site Scripting Vulnerabilities (2.3.11)

WordPress Plugin Advanced Woo Search Information Disclosure (1.99)

WordPress Plugin WP Front-End Repository Manager Arbitrary File Upload (1.1)

WordPress Plugin SEO Tools 'file' Parameter Directory Traversal (3.1.7)

WordPress Plugin copy-me Cross-Site Request Forgery (1.0.0)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Tags

Missing Update File Inclusion