CVE-2020-10564 Path traversal in n/a
A directory traversal in the WordPress File Upload plugin allows attackers to upload malicious files and execute remote code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10564?
CVE-2020-10564 is a critical path traversal vulnerability in n/a, published on 13 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfu_include_lib call.
Weakness: CWE-22
Which versions are affected by CVE-2020-10564?
It affects 1 product.
Products include Iptanus Wordpress File Upload.
How do I fix CVE-2020-10564?
No fix has been published for CVE-2020-10564 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-10564 being exploited?
There is no known exploitation of CVE-2020-10564 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-11613 Code injection in Iptanus File Upload
- CVE-2024-11635 WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
- CVE-2024-9047 The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php.
- CVE-2021-24962 WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
- CVE-2024-9939 WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
Sources
Also known as GHSA-jv5x-hvg3-3pjm.