CVE-2015-4455

Critical

Published: 23/05/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Aviary Image Editor Add-on for Gravity Forms plugin version 3.0 beta for WordPress has an unrestricted file upload vulnerability. This allows remote attackers to execute arbitrary code by uploading a file with an executable extension.

Risk Assessment

Attackers can exploit this vulnerability to remotely execute code on the server, potentially leading to system takeover or data leakage.

Recommendation

It is recommended to update the plugin to the latest version and implement strict file upload policies to restrict the uploading of files with dangerous extensions.

Original NVD description (English source)

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.