WordPress Plainview Activity Monitor 20161228 Remote Command Execution
Posted by deepcore on November 30, 2019 – 5:00 pm
WordPress Plainview Activity Monitor plugin is vulnerable to OS command injection which allows an attacker to remotely execute commands on the underlying system. Application passes unsafe user supplied data to ip parameter into activities_overview.php. Privileges are required in order to exploit this vulnerability. Vulnerable plugin version: 20161228 and possibly prior. Fixed plugin version: 20180826.
Post a reply
You must be logged in to post a comment.