The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated…
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Product
- WP Libre Form
- CVSS v3.1
- 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 38 (Notable)
- CVSS v3.1 10.0 critical
- Product class: web platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.