CVE-2016-15033

CVE-2016-15033 affects the WordPress Delete All Comments plugin (versions up to 2.0). The root cause is missing file type validation in delete-all-comments.php, enabling unauthenticated attackers to upload arbitrary files to the server, with potential remote code execution. Documented impact is a...

CVE-2016-15033 Delete All Comments <= 2.0 - Arbitrary File Upload

The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affecte...