Description

WordPress Plugin GraceMedia Media Player is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin GraceMedia Media Player version 1.0 is vulnerable.

Remediation

Disable the plugin until a fix is available

References

https://www.exploit-db.com/exploits/46537

https://packetstormsecurity.com/files/152074/WordPress-GraceMedia-Media-Player-1.0-Local-File-Inclusion.html

https://seclists.org/fulldisclosure/2019/Mar/26

Related Vulnerabilities

WordPress Plugin ALO EasyMail Newsletter Cross-Site Request Forgery (2.9.2)

WordPress Plugin Elementor Addon Elements Cross-Site Request Forgery (1.11.7)

Zenphoto Other Vulnerability (CVE-2007-0616)

WordPress Plugin BookX Local File Inclusion (1.7)

Oracle JRE CVE-2018-2588 Vulnerability (CVE-2018-2588)

Severity

High

Classification

CVE-2019-9618 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion