The Kaswara Modern VC Addons WordPress plugin up to and including 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
kaswara project kaswara |
Topics Security Off-Prem On-Prem Software Offbeat Vendor Voice Vendor Voice Resources All versions are susceptible, there's no patch, so now's a good time to remove this add-on What do you want The Register to do for you?
Miscreants have reportedly scanned almost 1.6 million websites in attempts to exploit an arbitrary file upload vulnerability in a previously disclosed buggy WordPress plugin. Traced as CVE-2021-24284, the vuln targets Kaswara Modern WPBakery Page Builder Addons and, if exploited, it would allow criminals to upload malicious JavaScript files and even completely take over an organization's website. Wordfence disclosed the flaw almost three months ago, and in a new advisory this week warned that cr...
Vulmon