CVE Database /
CVE-2020-24186
CVE · Critical
CVE-2020-24186 — Comments – wpDiscuz [wpdiscuz] >= 7.0 - <= 7.0.4
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2020-24186
|
Comments – wpDiscuz [wpdiscuz] >= 7.0 - <= 7.0.4 |
Unrestricted Upload of File with Dangerous Type |
Critical
10.0
|
7.0–7.0.5
|
7.0.5 |
2020-07-28 |
—
|
CVE-2020-24186
The wpDiscuz plugin versions 7.0 to 7.0.4 contains a remote code execution flaw that permits unauthenticated attackers to execute arbitrary code by uploading malicious files, including PHP scripts, through the wmuUploadFiles AJAX endpoint. This vulnerability allows an attacker without credentials to bypass file upload restrictions and achieve code execution on the affected WordPress installation. The issue affects all versions from 7.0 up to and including 7.0.4.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings