WP Libre Form plugin lets unauthenticated attackers upload and run PHP files
Anyone can upload malicious files through this WordPress form plugin and hack the website!
Summary
The WP Libre Form WordPress plugin does not check the type of files uploaded through its forms, so unauthenticated attackers can upload PHP files and run them on the server. Sites running this plugin are affected.
What to do
No fixed version is named yet. Check that the plugin runs a version newer than 1.5.0.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen