Description

WordPress Plugin Simple:Press is prone to security bypass and arbitrary file upload vulnerabilities. Attackers can leverage these issues to bypass certain security restrictions and to upload and execute arbitrary code in the context of the application. WordPress Plugin Simple:Press versions prior to 4.1.3 are vulnerable.

Remediation

Update to plugin version 4.1.3 or latest

References

http://simple-press.com/security-release-4-1-3-now-available/

http://secunia.com/advisories/39923/

Related Vulnerabilities

MediaWiki Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2021-44856)

WordPress Plugin WordPress Easy Custom Js And Css Cross-Site Scripting (1.1.2)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-32621)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-3550)

Craft CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-37250)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass Unauthenticated File Upload CWE-264 CWE-434