CVE-2015-4153 ZM Ajax Login & Register <= 1.0.9 - Local File Inclusion
MediumCVSS 5.0
EPSS 13.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a load_template action to wp-admin/admin-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zanematthew zm ajax login register | <= 1.0.9 | No fix listed |
| wordpress zm-ajax-login-register(WordPress) | < 1.1.0 | 1.1.0 |
References
- packetstormsecurity.com exploit
- 20150604 CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin [Local File Inclusion] mailing-list
- 75041 vdb-entry
- GLSA-201512-10 vendor-advisory
- wordpress.org vendor-advisory
- 37200 exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org