CVE-2013-7102

Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

14.80% chance of exploitation in the next 30 days, 96th percentile

Published

2013-12-23

Updated

2024-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_optimizepress_upl…

References

• CVE Record
• NVD entry

Related

• CVE-2013-7097
• CVE-2013-7108
• CVE-2013-7091
• CVE-2013-7136
• CVE-2013-7071
• CVE-2013-7137