Description
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via a CSRF attack, leading to Remote Code Execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Gpx2Graphics | ≤ 0.3 | — |
References
- https://wpscan.com/vulnerability/92e50025-cfa4-4727-bd02-8f45196021ae/ exploit vdb-entry technical-description