CVE-2015-5682
HighSummary
The Powerplay Gallery plugin version 3.3 for WordPress contains a vulnerability in upload.php that allows remote attackers to create arbitrary directories by manipulating the targetDir variable.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the file system, potentially leading to further attacks on the server.
Recommendation
It is recommended to update the Powerplay Gallery plugin to the latest version to mitigate this vulnerability and to monitor server logs for potential attack attempts.
Other vulnerabilities in Powerplay Gallery plugin 3.3 for WordPress
See all- CVE-2015-5681High
The Powerplay Gallery plugin version 3.3 for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- CVE-2015-5599High
The Powerplay Gallery plugin version 3.3 for WordPress contains multiple SQL injection vulnerabilities in upload.php that allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Original NVD description (English source)
upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.