Beauty & Clean <= 1.0.8 - Cross-Site Request Forgery & Arbitrary File Upload
highThe beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php. This can also be exploited without using CSRF tactics.
- CVSS:
- 8.8
- Affected:
- up to 1.0.8
- Fix:
- No patched version reported
- Disclosed:
- Mar 11, 2016