CVE-2020-35945 File upload in n/a
Authenticated contributors can upload arbitrary PHP files due to client-side validation, enabling remote code execution on WordPress sites using Divi.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-35945?
CVE-2020-35945 is a critical vulnerability in n/a, published on 1 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.
Weakness: CWE-434
Which versions are affected by CVE-2020-35945?
It affects 3 products.
Products include Elegantthemes Divi, Elegantthemes Divi Builder, Elegantthemes Extra.
How do I fix CVE-2020-35945?
No fix has been published for CVE-2020-35945 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-35945 being exploited?
There is no known exploitation of CVE-2020-35945 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-29099 WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-5533 Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2023-6744 Divi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2015-1579 Path traversal in n/a
Sources
Also known as GHSA-v452-696f-f255.