Race condition

2017-11-1709:29:00

PRIOn knowledge base

www.prio-n.com

8.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.3%

JSON

DISPUTED The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary.

CPENameOperatorVersion
updraftplusle1.13.12

CPE	Name	Operator	Version
	updraftplus	le	1.13.12

References

github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity