by Kastro
Paper/Archive/CVE-2020-24186

CVE-2020-24186

mitre — A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticate…

EPSS 95%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA, NVD agree)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 99.9.999 × 2020.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)10.0CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refwordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-pluginrefpacketstormsecurity.com/files/162983/WordPress-wpDiscuz-7.0.4-Shell-Upload.htmlrefpacketstormsecurity.com/files/163012/WordPress-wpDiscuz-7.0.4-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/163302/WordPress-wpDiscuz-7.0.4-Shell-Upload.html