WordPress Plugin Vulnerabilities

OoohBoi Steroids for Elementor < 2.1.5 - Arbitrary File Upload

Description

The plugin does not properly protect its file_uploader_callback function with capability checks, which makes it possible for attackers with a low-privilege account, like subscribers, to upload image attachments to the site.

Affects Plugins

Plugin icon
ooohboi-steroids-for-elementor
Fixed in 2.1.5

References

CVE
CVE-2023-1169

Miscellaneous

Original Researcher
Ramuel Gall
Verified
No
WPVDB ID
c0620ecc-b9c0-425d-9abb-4fb94c9f7753

Timeline

Publicly Published
2023-04-18 (about 3 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2023-06-09 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Image Manager - Shell Upload
Published
2024-08-21
Title
AcyMailing < 9.8.0 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Published
2024-11-19
Title
Fediverse Embeds < 1.5.4 - Unauthenticated Arbitrary File Upload
Published
2025-04-17
Title
I Draw <= 1.0 - Authenticated (Author+) Arbitrary File Upload
Published
2016-06-22
Title
Cherry Plugin < 1.2.7 - Unauthenticated Arbitrary File Upload and Download