Skip to content
Sign in
Not rated

CVE-2021-25004 The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is…

Description

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.

Affected products and versions

Product Affected versions Fixed in
SEUR Oficial 1.7 earliest → < 1.7.2 1.7.2

Other CVEs of SEUR Oficial

The 2 CVEs of SEUR Oficial →
CVE-2021-25005 The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege… Not rated
Track this CVE