WordPress Plugin Vulnerabilities

Two Way Chat < 3.1.5 - Admin+ Local File Inclusion

Description

The plugin does not properly sanitise and validate user input before using in require statements, leading to Local File Inclusion issues

Proof of Concept

Affects Plugins

Plugin icon
twchat
Fixed in 3.1.5

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
2.7 (low)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
84b693ab-590d-4d67-96ed-7c874ada1f46

Timeline

Publicly Published
2021-10-05 (about 4 years ago)
Added
2021-10-05 (about 4 years ago)
Last Updated
2021-10-05 (about 4 years ago)

Other

Published
Title
Published
2025-02-21
Title
MyTicket Events <= 1.2.4 - Unauthenticated Limited File Read
Published
2024-07-11
Title
HT Mega < 2.5.8 - Authenticated (Contributor+) JSON File Directory Traversal
Published
2025-05-02
Title
Web3Press < 3.3.0 - Authenticated (Contributor+) Arbitrary File Read
Published
2024-08-12
Title
Bit Form Pro < 2.8.0 - Unauthenticated Arbitrary File Deletion
Published
2025-08-27
Title
File Manager, Code Editor, and Backup by Managefy < 1.5.0 - Authenticated (Admin+) Path Traversal to Arbitrary File Download