CVE-2020-24186

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1880%

EPSS Percentile15.55th

Published2020年8月24日

Last Modified2024年11月21日

Vulnerability Description

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

Affected Platforms (CPE)

📦

Gvectors

Wpdiscuz

>= 7.0 and <= 7.0.4

References & Advisories

🔗 http://packetstormsecurity.com/files/162983/WordPress-wpDiscuz-7.0.4-Shell-Upload.html

🔗 http://packetstormsecurity.com/files/163012/WordPress-wpDiscuz-7.0.4-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/163302/WordPress-wpDiscuz-7.0.4-Shell-Upload.html

🔗 https://www.wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin/