WordPress ShowBiz Pro <= 1.7.1 - Authenticated Arbitrary File Upload to RCE
Short Info
Level
Critical
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
15 days 5 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
-
The WordPress ShowBiz Pro plugin version <= 1.7.1 allows arbitrary PHP file upload via the `admin-ajax.php` endpoint.This leads to unauthenticated remote code execution.
References:
