Description
The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upload_ajax_handler() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload safe media files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
apprhyme URL Media Uploader
Default version status: unaffected
0 to ≤ 1.0.1affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/57f09da9-0d2c-45db-b3ed-19a7c9f5a001?source=cve ↗
- https://plugins.trac.wordpress.org/browser/url-media-uploader/trunk/url-media-uploader.php#L52 ↗
- https://gist.github.com/jasoncarle/925401bb11833b1ced2342390e20718e ↗
- https://plugins.trac.wordpress.org/browser/url-media-uploader/tags/1.0.1/url-media-uploader.php#L52 ↗