Webinfos
Monthly
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.
Unauthenticated remote code execution in the Webinfos WordPress plugin (versions through 1.2) lets any anonymous attacker upload arbitrary files - including PHP webshells - because the plugin's upload handler enforces no file-type validation, authentication, capability, or nonce checks. On servers that execute PHP from the uploads directory, this yields full server compromise. Publicly available exploit code exists (reported by WPScan), and while EPSS is currently low at 0.28%, the CVSS 9.8 rating and automatable, unauthenticated nature make this a high-priority patch target.