CVE-2017-1002016

CVE-2017-1002016 affects the WordPress plugin flickr-picture-backup (v0.7). The vulnerability arises in flickr-picture-download.php, which does not verify user authentication or permissions before handling file uploads, enabling unauthenticated arbitrary file upload. Public sources (NVD, Red Hat,...

Larry's Cabinet of Web Vulnerability Curiosities

One of my responsibilities as a member of the Akamai Security Intelligence Response Team SIRT is to research new web application vulnerabilities. For the last year, I have focused on Wordpress plugin vulnerabilities, and looking for any interesting code tidbits in my box of Wordpress toys. There...