Input validation

2023-06-0702:15:00

PRIOn knowledge base

www.prio-n.com

adsanity

wordpress

arbitrary file uploads

remote code execution

nvd

file type validation

contributor+ level privileges

8.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.9%

JSON

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘ajax_upload’ function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible.