Description

WordPress Plugin WP Editor is prone to multiple vulnerabilities, including arbitrary file modification and arbitrary file disclosure vulnerability. An attacker can exploit these vulnerabilities to modify local files in the context of the web server process, which may result in privilege escalation, or to view local files (eg. server configuration), which may aid in launching further attacks. WordPress Plugin WP Editor version 1.2.5.3 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 1.2.6 or latest

References

https://www.pluginvulnerabilities.com/2016/05/12/authenticated-file-modification-vulnerability-in-wp-editor/

https://www.pluginvulnerabilities.com/2016/05/13/authenticated-file-viewing-vulnerability-in-wp-editor/

https://wordpress.org/plugins/wp-editor/changelog/

Related Vulnerabilities

WebLogic CVE-2022-21361 Vulnerability (CVE-2022-21361)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-12466)

Internet Information Services Improper Authentication Vulnerability (CVE-2009-1122)

WordPress Plugin Multisite Plugin Manager Multiple Cross-Site Scripting Vulnerabilities (3.1.1)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Scripting (2.3.2)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update CWE-22 CWE-88