Description

WordPress Plugin WP Payeezy Pay is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin WP Payeezy Pay version 2.97 is vulnerable; prior versions are also affected.

Remediation

Update to plugin version 2.98 or latest

References

https://www.pluginvulnerabilities.com/2018/12/06/our-improved-proactive-monitoring-has-now-caught-a-local-file-inclusion-lfi-vulnerability-as-well/

https://plugins.svn.wordpress.org/wp-payeezy-pay/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin RSVPMaker SQL Injection (6.1.9)

WordPress Plugin CMS Press Cross-Site Scripting (0.2.3)

WordPress Plugin Download from files Arbitrary File Upload (1.48)

WordPress Plugin WP Import Export Lite Security Bypass (3.9.4)

WordPress Plugin Loginizer Multiple Vulnerabilities (1.3.5)

Severity

High

Classification

CVE-2018-20985 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update File Inclusion