Custom Content Type Manager 0.9.8.7 - 0.9.8.8 - Malicious Backdoor
2016-03-04 00:00
AnonymousStrategic Overview
StatusPatched in 0.9.8.9
Affected PluginCustom Content Type Manager
Affected Version
0.9.8.7 – 0.9.8.8CVSS9.8Critical
CVE
N/AVulnerability Overview
The Custom Content Type Manager plugin for WordPress was injected with a malicious backdoor in versions 0.9.8.7 to 0.9.8.8 that made it possible for attackers to gain access to the server to run code by installing malicious PHP files via the added auto-update.php file.
Technical Analysis
REMEDIATION: Update to version 0.9.8.9, or a newer patched version --- IDENTIFIER: CWE-434 (Unrestricted Upload of File with Dangerous Type) The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C