WordPress Plugin Vulnerabilities

User Submitted Posts < 20190501 - Arbitrary File Upload

Description

Note: Apache + PHP FastCGI required for exploitation

Affects Plugins

Plugin icon
user-submitted-posts
Fixed in 20190501

References

CVE
CVE-2019-25138
URL
https://blog.nintechnet.com/arbitrary-file-upload-vulnerability-in-wordpress-user-submitted-posts-plugin/

Miscellaneous

Original Researcher
NinTechNet
Verified
No
WPVDB ID
17212fee-05ca-40cf-916a-695c3a2cf02f

Timeline

Publicly Published
2019-05-02 (about 6 years ago)
Added
2019-06-07 (about 6 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2022-10-28
Title
Api2Cart Bridge Connector < 1.2.0 - Unauthenticated Arbitrary File Upload
Published
2020-08-29
Title
Quiz and Survey Master < 7.0.2 - Unauthenticated Arbitrary File Upload
Published
2024-11-11
Title
Devexhub Gallery <= 2.0.1 - Unauthenticated Arbitrary File Upload
Published
2025-09-05
Title
Multi Step Form < 1.7.26 - Authenticated (Admin+) Arbitrary File Upload
Published
2022-03-28
Title
Tatsu < 3.3.12 - Unauthenticated RCE