CVE-2015-5482

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3

Description The issue allows remote administrators to include and execute arbitrary local files. This can be achieved by using a .. (dot dot) in the tab parameter in the "gdbbpress attachments" page to "wp-admin/edit.php".

Recommendations For versions prior to 2.3, update to version 2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "gdbbpress attachments" page in "wp-admin/edit.php" to minimize the risk of exploitation. Avoid using the tab parameter in the affected page until the issue is resolved.