Description

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.

Remediation

References

CVE-2013-5739

Related Vulnerabilities

WordPress Plugin MasterStudy LMS-for Online Courses and Education Privilege Escalation (3.3.1)

WordPress 4.9.x Multiple Vulnerabilities (4.9 - 4.9.8)

Ruby on Rails CVE-2013-0277 Vulnerability (CVE-2013-0277)

Magento CVE-2019-8231 Vulnerability (CVE-2019-8231)

WordPress Other Vulnerability (CVE-2006-6808)

Severity

Low

Classification

CVE-2013-5739 CWE-707

Tags

Missing Update Known Vulnerabilities