All CVEs — page 351 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows unauthenticated attackers to read, write, or delete arbitrary files on the server via the Ninja Forms - File Uploads plugin for WordPress, specifically through the Amazon S3 external upload flow.
The SiteOrigin Widgets Bundle plugin has a local file inclusion vulnerability that allows authenticated users with contributor level access or higher to execute arbitrary PHP code on the server by manipulating widget data through a REST endpoint. This can lead to complete compromise of the WordPress site.
The WordPress plugin fails to authenticate or validate nonces on a critical action that triggers slow server-side requests, allowing attackers to exhaust PHP worker pools and cause a complete site outage without any credentials or interaction.