Description

WordPress Plugin Simple:Press is prone to security bypass and arbitrary file upload vulnerabilities. Attackers can leverage these issues to bypass certain security restrictions and to upload and execute arbitrary code in the context of the application. WordPress Plugin Simple:Press versions prior to 4.1.3 are vulnerable.

Remediation

Update to plugin version 4.1.3 or latest

References

http://simple-press.com/security-release-4-1-3-now-available/

http://secunia.com/advisories/39923/

Related Vulnerabilities

Drupal Core 8.x Multiple Vulnerabilities (8.0.0 - 8.4.4)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-17318)

WordPress Plugin Tutor LMS-eLearning and online course solution Cross-Site Request Forgery (2.6.1)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3546)

WordPress Plugin PG Flash Gallery Cross-Site Scripting (4.1.1)

Severity

High

Classification

CWE-264 CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass Unauthenticated File Upload