Lucene search
José AguileraWPEX-ID:67398332-B93E-46AE-8904-68419949A124HistoryDec 01, 2021 - 12:00 a.m.
CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal
2021-12-0100:00:00
José Aguilera
37
caos plugin exploit
admin privileges
arbitrary folder deletion
path traversal
uninstall settings
EPSS
0.001
Percentile
25.9%
The plugin does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
As admin, put the following payload in the "Cache directory for analytics.js" setting of the plugin: ../wp-includes, tick the "Remove settings at Uninstall" setting and uninstall the plugin to delete the wp-includes folderRelated
nvd
nvd
CVE-2021-25020
2022-01-03 13:15:08
prion
prion
Path traversal
2022-01-03 13:15:00
cve
cve
CVE-2021-25020
2022-01-03 13:15:08
cnvd
cnvd
WordPress plugin CAOS|Host Google Fonts Locally path traversal vulnerability
2022-01-05 00:00:00
cvelist
cvelist
patchstack
patchstack
wpvulndb
wpvulndb
CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal
2021-12-01 00:00:00