CVE-2025-13322
HighSummary
Wtyczka WP AUDIO GALLERY dla WordPressa jest podatna na nieautoryzowane usuwanie plików z powodu niewystarczającej walidacji ścieżek plików we wszystkich wersjach do 2.0 włącznie. Problem wynika z nieprawidłowej walidacji ścieżek plików dostarczanych przez użytkowników w parametrze `audio_upload` przez handler AJAX `wpag_uploadaudio_callback()`.
Risk Assessment
Atakujący z poziomem dostępu subskrybenta lub wyższym mogą usunąć dowolne pliki na serwerze, co może prowadzić do zdalnego wykonania kodu, jeśli zostaną usunięte krytyczne pliki, takie jak wp-config.php.
Recommendation
Zaleca się aktualizację wtyczki WP AUDIO GALLERY do najnowszej wersji, aby usunąć tę podatność oraz wdrożenie dodatkowych mechanizmów zabezpieczeń, takich jak ograniczenie dostępu do krytycznych plików systemowych.
Related vulnerabilities
- CVE-2025-12999Critical
A vulnerability in Open VSX allows an unauthenticated attacker to poison the per-extension metadata cache by supplying a crafted X-Forwarded-Host header, replacing download, signature, and public-key URLs with attacker-controlled ones. The cache keys do not include the host, so poisoned entries are served to all clients for the entry's lifetime (1 hour by default, cluster-wide with Redis).
- CVE-2026-82187Critical
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it. This allows unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.
- CVE-2026-94101Critical
A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected function is vlan_load_form_uci in /usr/bin/routerd, where manipulation of the wan_num argument leads to buffer overflow. The attack can be initiated remotely and the exploit is publicly disclosed.
- CVE-2026-94100Critical
A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. The affected function is wan_config_set_vlan in /usr/bin/routerd, where manipulation of the vlan_wanX.ports argument leads to buffer overflow. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-94099Critical
A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. The issue affects the restore.cgi file in the Backup Restore component, where manipulation of the QUERY_STRING argument results in command injection. The attack can be carried out remotely and the exploit is publicly released.
- CVE-2026-94098Critical
A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/upgrade file in the Firmware Upgrade CGI Endpoint component, where manipulation of the QUERY_STRING argument leads to command injection. The attack can be executed remotely and the exploit is publicly available.
- CVE-2026-94097Critical
A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /www/cgi-bin/network_tools file in the CGI Diagnostic Endpoint component, where manipulation of the param/key/val arguments causes command injection. Remote exploitation is possible and the exploit has been publicly disclosed.
- CVE-2026-94096Critical
A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the LAN IP Configuration Handler component, where manipulation of the ipv4 argument results in command injection. The attack may be launched remotely and the exploit has been made public.
- CVE-2026-94095Critical
A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. The vulnerability affects the /usr/bin/network_tools file in the Traceroute Diagnostic Feature component, where manipulation of the url argument leads to command injection. The attack may be initiated remotely and the exploit has been disclosed publicly.
- CVE-2026-94089Critical
A vulnerability was found in D-Link DIR-868L 2.01b05 in the strcpy function of the file /webfa_authentication.cgi in the Authentication Handler component. Manipulating the id/password arguments leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and including, 2.0. This is due to the `wpag_uploadaudio_callback()` AJAX handler not properly validating user-supplied file paths in the `audio_upload` parameter before passing them to `unlink()`. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when critical files like wp-config.php are deleted.