Vulnerability Description
Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Aviary Image Editor Add-On For Gravity Forms Project | Aviary Image Editor Add-On For Gravity Forms | <= 3.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/132256/WordPress-Aviary-Image-Editor-Add-OnExploitThird Party Advisory
- http://www.vapid.dhs.org/advisory.php?v=125ExploitThird Party Advisory
- http://packetstormsecurity.com/files/132256/WordPress-Aviary-Image-Editor-Add-OnExploitThird Party Advisory
- http://www.vapid.dhs.org/advisory.php?v=125ExploitThird Party Advisory
FAQ
What is CVE-2015-4455?
CVE-2015-4455 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by upl...
How severe is CVE-2015-4455?
CVE-2015-4455 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2015-4455?
Check the references section above for vendor advisories and patch information. Affected products include: Aviary Image Editor Add-On For Gravity Forms Project Aviary Image Editor Add-On For Gravity Forms.