CVE-2013-1916
N/A
N/A
Summary
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | WordPress Plugin User Photo | WordPress Plugin User Photo 0.9.4 | affected |
Weaknesses
- CWE-434: CWE-434
ADP Enrichment
CVE Program Container
Additional References
- https://wordpress.org/plugins/user-photo/#developers
- https://plugins.trac.wordpress.org/changeset/347137
- https://www.exploit-db.com/exploits/16181
References
- https://wordpress.org/plugins/user-photo/#developers
- https://plugins.trac.wordpress.org/changeset/347137
- https://www.exploit-db.com/exploits/16181
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.