CRITICAL🇵🇱 Wersja polska

CVE-2017-16949

CVSS 9.8v3.0pub. 2017-12-19upd. 2026-05-13

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Accesspressthemes Anonymous Post Pro

    APP
    Accesspressthemes
    ≤ 3.1.9
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2021-24867CRITICAL9.8PL ✓same vendor

Backdoor w wtyczkach i motywach AccessPress Themes

CVE-2017-15919CRITICAL9.8PL ✓same vendor

SQL Injection z PHP Object Injection w pluginie Ultimate Form Builder Lite dla WordPress

CVE-2023-28661HIGH8.8same vendor

The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnera...

CVE-2022-23976HIGH8.1same vendor

Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset al...

CVE-2022-23911HIGH7.2same vendor

The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter b...