WordPress Work The Flow File Upload Plugin Arbitrary File Upload Vulnerability

Key Information Description Vulnerability Type: Arbitrary file upload vulnerability in the WordPress plugin Work The Flow. Cause: The application fails to properly sanitize user input, allowing attackers to upload arbitrary files. Impact: Attackers can exploit this vulnerability to upload malicious code and execute it within the web server process, potentially leading to unauthorized access or privilege escalation. Severity Level: High Classification CWE ID: CWE-434 CVSS Score: - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VCH/V:H/VA:H/SC:N/SE:N/SA:I/N Remediation Recommendation Action: Update the plugin to version 2.5.3 or later. References HomeLab Exploit-DB PacketStormSecurity PacketStormSecurity GitHub Related Vulnerabilities XWiki Credential Management Error Vulnerability (CVE-2005-4862) Joomla! Core Cross-Site Scripting (1.7.0 - 3.9.5) WordPress Plugin MW WP Forms Directory Traversal (4.4.2) Dolibarr Improper Input Handling During Webpage Generation ('Cross-Site Scripting') Vulnerability (CVE-2017-14241) PHP Other Vulnerability (CVE-2005-3054)

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Work The Flow File Upload Plugin Arbitrary File Upload Vulnerability