CVE-2024-9047: Improper Limitation of a Pathname to a Restricted Directory

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfufiledownloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitatio...

Default credentials

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes...

CVE-2014-5199

CVE-2014-5199 is a CSRF vulnerability in the WordPress File Upload plugin (wp-file-upload) for WordPress, affecting versions before 2.4.2. The issue allows remote attackers to hijack the administrator’s authentication for requests that change plugin settings via unspecified vectors. Root cause is...

PT-2014-6338

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin wp-file-upload versions prior to 2.4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that change plugin settings...

CVE-2014-5199: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WordPress File Upload plugin wp-file-upload before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these details are...