Interactive Real Estate WordPress plugin arbitrary file upload
On a WordPress real estate plugin, logged-in users can hack the server.
Summary
A missing permission check in the plugin's ZIP import lets logged-in users with subscriber-level access or higher upload files that may be executable. This can allow remote code execution, and versions up to and including 2.6.0 are affected.
Affected when
- Sites where the Freemius Premium license or trial is active
- Logged-in account with subscriber-level access or higher
What to do
Check that you run a version newer than 2.6.0 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen