8.1
Élevée
CVE-2024-7626 The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to…
Description
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) 1.6 | premières → 1.6.9 | Pas de correctif indiqué |
| wpdelicious 1.6 | premières → 1.6.9 | Pas de correctif indiqué |
Autres CVE de WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
Les 4 CVE de WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) →
CVE-2026-15099
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block…
6.4
Moyenne
CVE-2025-11755
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to…
8.8
Élevée
CVE-2022-4974
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
6.3
Moyenne