BuddyBoss App plugin arbitrary file upload allows remote code execution
Subscribers on a WordPress app plugin can upload runnable files and hack the server.
Summary
The BuddyBoss App WordPress plugin's feedback function does not properly check uploaded file types. An authenticated user with Subscriber-level access or above may upload executable files, which may allow remote code execution; all versions up to and including 3.2.1 are affected.
Affected when
- Authenticated account with Subscriber-level access or above
- BuddyBoss App up to and including 3.2.1
What to do
Check that the plugin runs a version newer than 3.2.1 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen