Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
highThe Media.net Ads Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and missing capability check in the 'sendMail' function in all versions up to, and including, 2.10.13. This makes it possible for authenticated attackers, with subscriber-level and above permission...
- CVSS:
- 8.8
- Affected:
- up to 2.10.13
- Fix:
- No patched version reported
- Disclosed:
- Jul 26, 2024