by Kastro
Paper/Archive/CVE-2020-35949

CVE-2020-35949

mitre — An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.

EPSS 5%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 92.4.924 × 2018.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)10.0CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-pluginrefwpscan.com/vulnerability/10349