Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can specify a local file inclusion via WordPress Swim
Team, in order to read any server file.

Impacted products: WordPress Plugins not comprehensive.

Severity: 2/4.

Creation date: 06/07/2015.

DESCRIPTION OF THE VULNERABILITY

The Swim Team plugin can be installed on WordPress.

However, user’s data are directly inserted in an access path.
Notably, absolute patch are accepted as is, which allows to
include any file that is readable with the web server access
rights.

An attacker can therefore specify a local file inclusion via
WordPress Swim Team, in order to read any server file.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/WordPress-Swim-Team-local-File-Inclusion-17310