The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2023-06-07T01:51:50.838Z

Updated: 2024-08-03T01:55:46.127Z

Reserved: 2023-06-06T13:38:43.158Z

Link: CVE-2022-4949

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-06-07T02:15:15.750

Modified: 2024-11-21T07:36:18.687

Link: CVE-2022-4949

cve-icon Redhat

No data.