PT-2026-8044 · WordPress · Extension Zipper+1
CVSS v3.1
4.9
Média
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
BFG Tools – Extension Zipper plugin for WordPress versions through 1.0.7
Description
The BFG Tools – Extension Zipper plugin for WordPress is susceptible to a Path Traversal issue. This is caused by inadequate validation of the
first file parameter within the zip() function. An attacker with Administrator-level access or higher can potentially read the contents of arbitrary files and directories outside the expected /wp-content/plugins/ directory, potentially exposing sensitive information like wp-config.php.Recommendations
Update the BFG Tools – Extension Zipper plugin to a version newer than 1.0.7.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Bfg Tools – Extension Zipper
Extension Zipper