CVE-2015-8351

Critical

Published: 11/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Gwolle Guestbook plugin before version 1.5.4 for WordPress has a PHP remote file inclusion vulnerability when allow_url_include is enabled. This allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php.

Risk Assessment

This vulnerability could lead to the execution of malicious code on the server, posing a serious threat to the security of the application and user data. Additionally, it can be exploited to include and execute arbitrary local files via directory traversal sequences.

Recommendation

It is recommended to update the Gwolle Guestbook plugin to version 1.5.4 or later and to disable the allow_url_include option in the PHP configuration to minimize risk.

Original NVD description (English source)

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.