Описание
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.5.4 (исключая)
cpe:2.3:a:ffw:omgf:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 53%
0.003
Низкий
8.1 High
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-22
CWE-22
Связанные уязвимости
CVSS3: 8.1
github
больше 3 лет назад
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
EPSS
Процентиль: 53%
0.003
Низкий
8.1 High
CVSS3
5.5 Medium
CVSS2
Дефекты
CWE-22
CWE-22