All CVEs — page 257 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory, due to insufficient validation of JSON field declarations and a bypassable ABSPATH guard.
The flaw allows authenticated attackers to upload executable files, leading to remote code execution, due to missing file type validation.