WordPress Plugin Vulnerabilities
Aviary Image Editor Add-on For Gravity Forms <= 3.0beta - Unauthenticated File Upload
Description
There is a remote file upload vulnerability in aviary-image-editor-add-on-for-gravity-forms/includes/upload.php. An unauthenticated user can upload any file to the system, including PHP files.
upload.php does not check that the user is authenticated and a simple POST request will allow arbitrary code to be uploaded to the server.
Affects Plugins
No known fix References
Miscellaneous
Submitter
Larry W. Cashdollar
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2015-06-09 (about 10 years ago)
Added
2015-06-09 (about 10 years ago)
Last Updated
2020-09-22 (about 5 years ago)
WPScan 