9.8
Critical
CVE-2023-5604 The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress…
Description
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Asgaros Forum 2.7 | earliest → < 2.7.1 | 2.7.1 |
| asgaros_forum 2.71 | earliest → < 2.71 | 2.71 |
Other CVEs of Asgaros Forum
The 4 CVEs of Asgaros Forum →
CVE-2022-0411
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in…
Not rated
CVE-2021-25045
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it…
Not rated
CVE-2021-24827
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic…
Not rated