WordPress College publisher Import plugin file upload vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.College publisher Import is a plugin for WordPress. A file upload vulnerability exists in WordPress College publisher...

WordPress plugin College publisher Import 代码问题漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.College publisher Import is a plugin for WordPress. A file upload vulnerability exists in WordPress College publisher...

CVE-2021-24254

The CVE-2021-24254 entry concerns WordPress College publisher Import plugin (versions ≤ 0.1). The vulnerability stems from the plugin not validating the uploaded CSV for import, enabling high-privilege users to upload arbitrary files (e.g., PHP), which can lead to remote code execution (RCE). A C...

CVE-2021-24254 College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack...

WordPress College publisher Import plugin <= 0.1 - Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Jin Huang in WordPress College publisher Import plugin versions = 0.1. Solution This plugin has been closed as of April 12, 2021 and is not available for download. This closure is temporary, pending a full revi...

College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

The plugin does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack. The issue has been escalated to WordPress on April 12th, 2021 Th...