Multi Plugin Installer < 1.2.0 - Arbitrary File Read
2015-08-24 00:00
Marcin ProbolaStrategic Overview
Vulnerability Overview
The Multi Plugin Installer plugin for WordPress is vulnerable to Arbitrary File Read in versions before 1.2.0. This is due to vulnerable parameters 'filepath' and 'filename' in the mpi_download_file function. This makes it possible for unauthenticated attackers to read arbitrary files.
Technical Analysis
REMEDIATION: Update to version 1.2.0, or a newer patched version --- IDENTIFIER: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C