CVE-2021-25004 SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download

2022-02-0715:47:15

CWE-552

WPScan

www.cve.org

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.9%

JSON

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.

CNA Affected

[
  {
    "product": "SEUR Oficial",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.7.2",
        "status": "affected",
        "version": "1.7.2",
        "versionType": "custom"
      }
    ]
  }
]