Frontend Admin by DynamiApps Plugin < 3.18.4 - Unauthenticated Arbitrary File Upload

2024-01-0300:00:00

wpscan.com

plugin

vulnerability

arbitrary file upload

missing validation

remote code execution

9.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the ‘ajax_add_attachment’ function, allowing unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.

CPENameOperatorVersion
eq3.18.4

CPE	Name	Operator	Version
		eq	3.18.4

References

patchstack.com/database/vulnerability/acf-frontend-form-element/wordpress-frontend-admin-by-dynamiapps-plugin-3-18-3-unauthenticated-arbitrary-file-upload-vulnerability