this can be very dangerous for a variety of reasons. One example is that the plugin does not have security features in place to prevent users from renaming a file, like not checking the file extension. Another example is that the plugin gives any user access to the file manager, which could allow them to upload any file they want. The last example is that the uploaded file could have any logic that the user wants, so it could be any binary that they want to do whatever they want. These are just a few ways that this can lead to RCE. Unfortunately, this plugin is still in active development, so there are still ways to exploit it, such as by using the search functionality from the admin panel to find a vulnerable package and upload it to the server, or by using the file upload functionality to upload arbitrary code to the server.
Check if the installed plugin is vulnerable to CVE-2022-3125
This vulnerability is serious and can be very dangerous. It is important to check if the plugin that you are using has a vulnerable version, so that you can avoid using it. Luckily, this plugin has a Vulnerable Version checker to tell you if the plugin is vulnerable or not. If it is, then you should use one of the other plugins on this website.
Timeline
Published on: 10/03/2022 14:15:00 UTC
Last modified on: 10/04/2022 20:44:00 UTC