WF-618f644b-a92c-4f7f-aaea-c03ee7d6e0f9
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin に報告された脆弱性
概要
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin plugin for WordPress is vulnerable to arbitrary file deletion and reading when the file upload functionality is enabled for the user profile and registration forms in versions up to, and including 2.0.45. This is due to the fact that the plugin did not perform sufficient file path validation or restrict the files that users had access to when performing a file download or deletion. This makes it possible for low-level privileged attackers to delete arbitrary files such as the wp-config.php file and ultimately achieve remote code execution.
影響を受けるバージョン
- 2.0.45 以下
対処方法
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin を 2.0.46 以降に更新してください。これで本脆弱性は解消します。
あなたのサイトは大丈夫ですか？
URLを入力するだけで、実際に使われているプラグインを検出し、 このデータベースと突き合わせて既知の脆弱性が残っていないかを確認できます。登録不要・無料です。
30秒で無料診断する