Elegance Vulnerabilities

Elegance theme's "elegance/lib/scripts/dl-skin.php" is prone to a local file disclosure vulnerability. It allows an attacker to get potentially sensitive information from local files on computers running the vulnerable application. Upgrade the theme.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Jun 8, 2014

The Elegance Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.4. This is due to the '_mysite_download_skin' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to download any file within the server of the vulnerable service.

CVSS:

7.5

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The Elegance Theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.4. This is due to the '_mysite_delete_skin_zip' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to delete any file on the server of the vulnerable service.

CVSS:

7.5

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The Elegance Theme for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.4. This is due to the '_mysite_download_skin' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to download any file within the server of the vulnerable service.

Affected:

up to 2.5

Fixed in:

2.5

Disclosed:

Dec 17, 2013

The Elegance Theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.4. This is due to the '_mysite_delete_skin_zip' parameter in the 'dl-skin.php' file. This makes it possible for unauthenticated attackers to delete any file on the server of the vulnerable service.

Affected:

up to 2.5

Fixed in:

2.5

Disclosed:

Dec 17, 2013