Aviary Image Editor Add On For Gravity Forms <= 3.0 is vulnerable to Beta Shell Upload

Unauthenticated

Published
2015-06-11

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.

CVE

https://www.cve.org/CVERecord?id=CVE-2015-4455

CVSS

Score:9.8

Severity:Critical

Version: 3.0

There is a patch available in v3.1 and we strongly recommend you update to this version as soon as possible.