The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://blog.nintechnet.com/arbitrary-file-upload-vulnerability-in-wordpress-delete-all-comments-plugin/ - Exploit | |
| References | () https://wordpress.org/plugins/delete-all-comments/#developers - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e98d2d-20b1-4fff-96d4-0fb8e0d2615a?source=cve - Third Party Advisory |
13 Jun 2023, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/b1e98d2d-20b1-4fff-96d4-0fb8e0d2615a?source=cve - Third Party Advisory | |
| References | (MISC) http://blog.nintechnet.com/arbitrary-file-upload-vulnerability-in-wordpress-delete-all-comments-plugin/ - Exploit | |
| References | (MISC) https://wordpress.org/plugins/delete-all-comments/#developers - Product | |
| CPE | cpe:2.3:a:delete_all_comments_project:delete_all_comments:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-434 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
07 Jun 2023, 02:45
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-11-21 02:45
NVD link : CVE-2016-15033
Mitre link : CVE-2016-15033
CVE.ORG link : CVE-2016-15033
JSON object : View
Products Affected
delete_all_comments_project
- delete_all_comments
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type