Image Upload For Bbpress Vulnerabilities

The Inline Image Upload for BBPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the file uploading functionality in all versions up to, and including, 1.1.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to uploa...

CVSS:

8.8

Affected:

up to 1.1.19

Fixed in:

1.1.20

Disclosed:

Mar 28, 2025

CVE-2025-2006 on NVD →

The Inline Image Upload for BBPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the hm_bbpui_admin_page function. This makes it possible for unauthenticated attackers to trigger a cleanup via a forged...

CVSS:

4.3

Affected:

up to 1.1.18

Fixed in:

1.1.19

Disclosed:

Dec 27, 2023

CVE-2023-51668 on NVD →