Instinct WP e-Commerce <= 3.4 - Arbitrary File Upload
criticalUnrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.
- CVSS:
- 9.8
- Affected:
- up to 3.4
- Fixed in:
- 3.6.8 RC1
- Disclosed:
- Oct 29, 2008