CVE-2013-7102 File upload in n/a
Remote attackers can execute arbitrary code by uploading malicious files to the OptimizePress WordPress theme, requiring low-privilege access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-7102?
CVE-2013-7102 is a medium-severity vulnerability in n/a, published on 23 Dec 2013. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images_comingsoon, images_lncthumbs, or images_optbuttons in wp-content/uploads/optpress/, as exploited in the wild in November 2013.
Weakness: CWE-20
Which versions are affected by CVE-2013-7102?
It affects 1 product.
Products include Optimizepress Optimizepress.
How do I fix CVE-2013-7102?
No fix has been published for CVE-2013-7102 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-7102 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-7102 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-vqcv-hf93-cvhh.