user_post_gallery Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/user_post_gallery/ Thu, 23 Feb 2023 05:20:36 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png user_post_gallery Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/user_post_gallery/ 32 32 CVE-2022-4060 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4060/ Thu, 23 Feb 2023 05:20:36 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4060/ The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

The post CVE-2022-4060 appeared first on CVE Vulnerability.

]]> The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.

The post CVE-2022-4060 appeared first on CVE Vulnerability.

]]> CVE-2023-0039 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0039/ Wed, 22 Feb 2023 14:02:10 +0000 http://www.cvevulnerability.com/?cve_vulnerabilities=cve-2023-0039 The User Post Gallery – UPG plugin for WordPress is vulnerable to authorization bypass which leads to remote command execution due to the use of a nopriv AJAX action and user supplied function calls and parameters in versions up to, and including 2.19. This makes it possible for unauthenticated attackers to call arbitrary PHP functions […]

The post CVE-2023-0039 appeared first on CVE Vulnerability.

]]> The User Post Gallery – UPG plugin for WordPress is vulnerable to authorization bypass which leads to remote command execution due to the use of a nopriv AJAX action and user supplied function calls and parameters in versions up to, and including 2.19. This makes it possible for unauthenticated attackers to call arbitrary PHP functions and perform actions like adding new files that can be webshells and updating the site’s options to allow anyone to register as an administrator.

The post CVE-2023-0039 appeared first on CVE Vulnerability.

]]>