Youtube Freedown <= 1.0 - Remote Media File Inclusion
Strategic Overview
Vulnerability Overview
The Youtube Freedown plugin for WordPress is vulnerable to Remote Media File Inclusion in versions up to, and including, 1.0 via the player.swf file. This allows unauthenticated attackers to include remote files on the server.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')) The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in require, include, or similar functions.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C