CVE-2015-5681
HighSummary
The Powerplay Gallery plugin version 3.3 for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Risk Assessment
Attackers can exploit this vulnerability to remotely execute code, potentially leading to server takeover and data leakage.
Recommendation
It is recommended to update the Powerplay Gallery plugin to the latest version and implement strict file upload policies to restrict the uploading of files with dangerous extensions.
Other vulnerabilities in Powerplay Gallery plugin 3.3 for WordPress
See all- CVE-2015-5682High
The Powerplay Gallery plugin version 3.3 for WordPress contains a vulnerability in upload.php that allows remote attackers to create arbitrary directories by manipulating the targetDir variable.
- CVE-2015-5599High
The Powerplay Gallery plugin version 3.3 for WordPress contains multiple SQL injection vulnerabilities in upload.php that allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Original NVD description (English source)
Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in *_uploadfolder/big/.