CVE-2024-10480

CVE-2024-10480 affects the 3DPrint Lite WordPress plugin prior to 2.1. The issue is a missing CSRF check when updating plugin settings, enabling a logged-in attacker to change settings via CSRF. The Red Hat/NVD entries describe the same flaw and patch in version 2.1 or later. Impact is limited to...

PT-2024-16308 · WordPress · 3Dprint Lite

Name of the Vulnerable Software and Affected Versions: 3DPrint Lite WordPress plugin versions prior to 2.1 Description: The issue is related to a lack of CSRF check when updating settings in the 3DPrint Lite WordPress plugin. This could allow attackers to make a logged-in admin change settings vi...

3DPrint Lite < 2.1 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC Have a logged in admin open an HTML page containing the following form:...

3DPrint Lite < 2.1 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Have a logged in admin open an HTML page containing the following form: input type="hidden" name="p3dlitesettingscanvaswidth"...

CVE-2021-4436

The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be access...

Design/Logic Flaw

The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be access...

CVE-2021-4436

The CVE-2021-4436 entry corresponds to the WordPress plugin 3DPrint Lite, affected versions prior to 1.9.1.5. The vulnerability is an unauthenticated arbitrary file upload via the p3dlite_handle_upload AJAX action, caused by missing authorization and file validation. The presence of a .htaccess d...

CVE-2021-4436 3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be access...

CVE-2021-4436 3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be access...

WordPress 3DPrint Lite plugin <= 1.9.1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress 3DPrint Lite plugin versions = 1.9.1.5. Solution Update the WordPress 3DPrint Lite plugin to the latest available version at least 1.9.1.6...

3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

Description The plugin does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as...

3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

Description The plugin does not have any authorisation and does not check the uploaded file in its p3dlitehandleupload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as...

WordPress 3DPrint Lite plugin <= 1.9.1.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Spacehen in WordPress 3DPrint Lite plugin versions = 1.9.1.4. Solution Update the WordPress 3DPrint Lite plugin to the latest available version at least 1.9.1.5...

WordPress 3DPrint Lite 1.9.1.4 Shell Upload

Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/3dprint-lite/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/ Version: spacehen www.github.com/spacehen" def printusage:...

Wordpress 3DPrint Lite 1.9.1.4 Plugin - Arbitrary File Upload Exploit

Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/3dprint-lite/ Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/ Version: spacehen www.github.com/spacehen" def printusage: print"Usage: python3...

Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload

Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload Google Dork: inurl:/wp-content/plugins/3dprint-lite/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/ Version: spacehen www.github.com/spacehen" def printusage:...