CVE-2013-1916

In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.

Affected

WordPress Plugin User Photo

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

12.85% chance of exploitation in the next 30 days, 96th percentile

Published

2022-06-24

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/16181

Security advisories

• https://plugins.trac.wordpress.org/changeset/347137
• https://wordpress.org/plugins/user-photo/#developers

References

• CVE Record
• NVD entry