Kish Guest Posting Vulnerabilities

The Kish Guest Posting plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation when double extensions are supplied in the uploadify/scripts/uploadify.php file in versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVSS:

9.8

Affected:

up to 1.2

Fix:

No patched version reported

Disclosed:

Mar 8, 2012

CVE-2012-5318 on NVD →

The Kish Guest Posting plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify/scripts/uploadify.php file in versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...

CVSS:

9.8

Affected:

up to 1.2

Fixed in:

1.2

Disclosed:

Jan 23, 2012

CVE-2012-1125 on NVD →