漏洞标题
现代事件日历 <= 7.11.0 - 认证（订阅者+）任意文件上传
漏洞描述信息
WordPress的现代事件日历插件在所有版本直至及包括7.11.0都存在任意文件上传漏洞，原因是set_featured_image函数中缺少文件类型验证。这意味着已认证的攻击者，具有订阅者权限或更高权限，可以在受影响网站的服务器上上传任意文件，这可能使远程代码执行成为可能。该插件允许管理员（通过其设置）扩展向未认证用户提交事件的能力，这将允许未认证的攻击者利用此漏洞。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
危险类型文件的不加限制上传
漏洞标题
Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload
漏洞描述信息
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
WordPress Plugin Modern Events Calendar 安全漏洞
漏洞描述信息
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin Modern Events Calendar 7.11.0及之前版本存在安全漏洞，该漏洞源于缺少文件类型验证，容易受到任意文件上传攻击，经过身份验证的攻击者能够将任意文件上传到受影响网站的服务器，从而实现远程代码执行。
CVSS信息
N/A
漏洞类别
其他