WordPress GD bbPress Attachments 2.1 Local File Inclusion

`Details  
================  
Software: GD bbPress Attachments  
Version: 2.1  
Homepage: http://wordpress.org/plugins/gd-bbpress-attachments/  
Advisory report: https://security.dxw.com/advisories/local-file-include-vulnerability-in-gd-bbpress-attachments-allows-attackers-to-include-arbitrary-php-files/  
CVE: Awaiting assignment  
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:N/A:P)  
  
Description  
================  
Local File Include vulnerability in GD bbPress Attachments allows attackers to include arbitrary PHP files  
  
Vulnerability  
================  
An attacker who is an admin can easily include any .php file on the server.  
An attacker who can get an admin to follow a link they control will also be able to include that PHP file. It is easy to make these links very convincing.  
They could exploit this to attempt to exhaust the server’s resources by including the file that includes the arbitrary file in an infinite loop.  
If they’re additionally able to upload arbitrary PHP files (via an admin account or some other vulnerability) they’ll be able to run arbitrary code on the server.  
  
  
Proof of concept  
================  
Visit this URL to cause an infinite loop:  
http://localhost/wp-admin/edit.php?post_type=forum&page=gdbbpress_attachments&tab=../panels  
  
Mitigations  
================  
Upgrade to version 2.2 or later  
  
Disclosure policy  
================  
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/  
  
Please contact us on [email protected] to acknowledge this report if you received it via a third party (for example, [email protected]) as they generally cannot communicate with us on your behalf.  
  
This vulnerability will be published if we do not receive a response to this report with 14 days.  
  
Timeline  
================  
  
2015-02-25: Discovered  
2015-07-01: Reported to vendor via email form on https://www.dev4press.com/contact/  
2015-07-01: Requested CVE  
2015-07-01: Vendor responded  
2015-07-09: Vendor confirmed fix  
2015-07-09: Published  
  
  
  
Discovered by dxw:  
================  
Tom Adams  
Please visit security.dxw.com for more information.  
  
  
  
  
`