Printcart Store plugin unauthenticated file upload allows remote code execution
A WordPress print plugin's upload setting lets strangers hack the site!
Summary
A flaw in the Printcart Store WordPress plugin lets an unauthenticated attacker write PHP files to arbitrary locations on the site and run code. Sites that set the upload popup to the advanced mode are affected.
Affected when
- nbdesigner_upload_popup_style site option set to a (Advanced Upload Popup)
What to do
Versions up to and including 2.13.2 are affected. Check that the site runs a newer version than 2.13.2 and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen