µAudio Player <= 0.6.2 - Remote File Inclusion
Strategic Overview
Vulnerability Overview
The µAudio Player plugin for WordPress is vulnerable to Remote File Inclusion of image files in versions up to, and including, 0.6.2 via the mediaplayer.swf file. This allows unauthenticated attackers to include remote files on the server.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')) The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in require, include, or similar functions.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C