WordPress Upload File Plugin SQL Injection
A SQL Injection vulnerability has been reported in WordPress by the Balsec Team. The advisory is lacking alot of detail.
This post will be updated as new information is made available.
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
Nick, your not missing anything at all. I assume they mean the upload page under wp-admin, however, the advisory is very vague.
I tried to look for the plugin mentioned, but no joy, there’s no reference to that file in the official plug-in svn either.
Maybe I’m missing something, but wp-uploadfile.php doesn’t appear to be a valid WP file?