plugin
4 known security issues reported for the Coditor WordPress plugin. Most recent disclosed Sep 22, 2020.
Running Coditor on your site? Check whether your installed version is affected.
Scan your site freeThe Coditor plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1 via the coditor_process_ajax function. This allows authenticated attackers at the subscriber-level or above to execute code on the server.
Arbitrary File Edition, Deletion and Internal Directory Listing in "/wp-content" vulnerabilities found by Slavco Mihajloski in WordPress Coditor plugin (versions <= 1.1).
The Coditor plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1 via the coditor_process_ajax function. This allows authenticated attackers at the subscriber-level or above to execute code on the server.
The coditor_process_ajax() AJAX call is missing any CSRF and authorisation checks, allowing low privilege users (subscriber+) to read and edit any files in the wp-content folder, as well as list its content.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free