PT-2025-17353 · WordPress · Aihub
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
AIHub theme for WordPress versions up to, and including, 1.3.7
Description
The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the
generate image function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.Recommendations
For versions up to, and including, 1.3.7, update to a version that includes the fix for the arbitrary file upload vulnerability.
As a temporary workaround, consider disabling the
generate image function until a patch is available.
Restrict access to the affected API endpoints to minimize the risk of exploitation.
Avoid using the AIHub theme until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.RCE
Unrestricted File Upload
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Aihub