Omgf Pro
Monthly
Unauthenticated arbitrary file download in OMGF Pro (versions 5.2.7 and earlier) allows any remote attacker to retrieve arbitrary files from the server filesystem without credentials, exposing sensitive data such as WordPress configuration files containing database credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms trivial network-based exploitation with high confidentiality impact and zero authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Patchstack advisory lowers the barrier for threat actor discovery significantly.
Arbitrary file upload in Daan.Dev's OMGF Pro WordPress plugin (versions through 5.2.6) lets remote attackers upload files of dangerous types, enabling webshell deployment and full site/server takeover. The CVSS 3.1 base score is 10.0 with a scope-changed vector, and the vector's PR:N indicates the flaw is reachable without authentication. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated arbitrary file download in OMGF Pro (versions 5.2.7 and earlier) allows any remote attacker to retrieve arbitrary files from the server filesystem without credentials, exposing sensitive data such as WordPress configuration files containing database credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms trivial network-based exploitation with high confidentiality impact and zero authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Patchstack advisory lowers the barrier for threat actor discovery significantly.
Arbitrary file upload in Daan.Dev's OMGF Pro WordPress plugin (versions through 5.2.6) lets remote attackers upload files of dangerous types, enabling webshell deployment and full site/server takeover. The CVSS 3.1 base score is 10.0 with a scope-changed vector, and the vector's PR:N indicates the flaw is reachable without authentication. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.