VulnerabilityModified

CVE-2015-1375

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.

HIGH 7.5EPSS 11.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 11.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 11.89% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: pixabay images project/pixabay images
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.htmlExploit
http://seclists.org/fulldisclosure/2015/Jan/75Exploit
http://www.exploit-db.com/exploits/35846Exploit
http://www.openwall.com/lists/oss-security/2015/01/25/5
http://www.osvdb.org/117146
http://www.securityfocus.com/archive/1/534505/100/0/threaded
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php
http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.htmlExploit
http://seclists.org/fulldisclosure/2015/Jan/75Exploit
http://www.exploit-db.com/exploits/35846Exploit
http://www.openwall.com/lists/oss-security/2015/01/25/5
http://www.osvdb.org/117146
http://www.securityfocus.com/archive/1/534505/100/0/threaded
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.