Description

WordPress Plugin Buddypress Component Stats is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Buddypress Component Stats version 1.0 is vulnerable.

Remediation

Disable the plugin until a fix is available

References

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/

Related Vulnerabilities

WordPress Plugin WPMK Ajax Finder Cross-Site Request Forgery (1.0.1)

ClipBucket Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2018-7664)

Drupal Core 4.6.x Mail Header Injection (4.6.0 - 4.6.5)

WordPress Plugin Elementor Addon Elements Cross-Site Request Forgery (1.6.3)

Jetty Improper Input Validation Vulnerability (CVE-2022-2047)

Severity

High

Classification

CVE-2014-2383 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion