PT-2025-38519 · WordPress+1 · Embed Pdf For Wpforms+1
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Embed PDF for WPForms plugin for WordPress versions up to and including 1.1.5
Description
The Embed PDF for WPForms plugin for WordPress is susceptible to arbitrary file uploads due to the absence of file type validation within the
ajax handler download pdf media function. This allows authenticated attackers with Subscriber-level access or higher to upload arbitrary files to the affected server, potentially leading to remote code execution.Recommendations
Update the Embed PDF for WPForms plugin to a version beyond 1.1.5.
Correção
RCE
Unrestricted File Upload
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Embed Pdf For Wpforms
Wpforms