Description
WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| abtest | Abtest | 1.0.6 | — |
References
- ExploitDB-39577 exploit
- Official Product Homepage product
- VulnCheck Advisory: WordPress Plugin Abtest Local File Inclusion via abtest_admin.php third-party-advisory