WordPress Plugin Vulnerabilities
Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
Description
The plugin does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
Proof of Concept
Affects Plugins
Fixed in 12.1.1 References
Miscellaneous
Original Researcher
Miguel Neto
Submitter
WPScan
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-05-30 (about 2 years ago)
Added
2023-05-30 (about 2 years ago)
Last Updated
2023-05-30 (about 2 years ago)
WPScan 