The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
Metrics
Affected Vendors & Products
References
History
Fri, 11 Oct 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-08-12T02:05:19.117Z
Updated: 2024-10-11T16:54:05.577Z
Reserved: 2023-06-28T19:14:28.550Z
Link: CVE-2023-3452
Vulnrichment
Updated: 2024-08-02T06:55:03.333Z
NVD
Status : Modified
Published: 2023-08-12T03:15:09.330
Modified: 2024-11-21T08:17:17.887
Link: CVE-2023-3452
Redhat
No data.