CVE-2015-1376 Pixabay Images <= 2.3 - Arbitrary File Upload
MediumCVSS 4.0
EPSS 33.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pixabay images project pixabay images | <= 2.3 | No fix listed |
| wordpress pixabay-images(WordPress) | < 2.4 | 2.4 |
References
- packetstormsecurity.com exploit
- 20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities exploit mailing-list
- 35846 exploit
- [oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities exploit mailing-list
- 20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities mailing-list
- plugins.trac.wordpress.org
- Wordfence Intelligence third-party-advisory
- www.cve.org