Contempo Real Estate Custom Posts <= 3.2.6 - Unauthorized File Upload
2022-08-05 00:00
AnonymousStrategic Overview
StatusPatched in 3.2.7
Affected PluginContempo Real Estate Custom Posts
Affected Version
<= 3.2.6CVSS8.8High
CVE
N/AVulnerability Overview
The Contempo Real Estate Custom Posts plugin for WordPress is vulnerable to unauthorized file uploads due to a missing capability check on the ct_front_img_upload() function called via an AJAX action in versions up to, and including 3.2.6. This makes it possible for authenticated attackers with subscriber level permissions and above to upload arbitrary files to the server.
Technical Analysis
REMEDIATION: Update to version 3.2.7, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C