WordPress File Upload <= 4.12.2 is vulnerable to Directory Traversal vulnerability leading to Remote Code Execution (RCE)

Unauthenticated

Published
2020-03-12

An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.

CVE

https://www.cve.org/CVERecord?id=CVE-2020-10564

CVSS

Score:9.8

Severity:Critical

Version: 4.12.2

There is a patch available in v4.13.0 and we strongly recommend you update to this version as soon as possible.