Description

Marc-Alexandre Montpas reported a security issue in the popular WordPress plugin WPtouch that could potentially allow a user with no administrative privileges, who was logged in (like a subscriber or an author), to upload PHP files to the target server.

Remediation

Upgrade to the latest version of WPtouch (this problem was fixed in version 3.4.3).

References

Disclosure: Insecure Nonce Generation in WPtouch

WPtouch Changelog

Related Vulnerabilities

OpenSSL Improper Authentication Vulnerability (CVE-2023-2975)

PrestaShop Improper Authentication Vulnerability (CVE-2020-15079)

WordPress Plugin Welcart e-Commerce Multiple Vulnerabilities (1.8.2)

Joomla Improper Authentication Vulnerability (CVE-2014-6632)

TYPO3 Improper Authentication Vulnerability (CVE-2015-2047)

Severity

High

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Arbitrary File Creation Weak Crypto