Wp Rest Api Fns
Monthly
Unrestricted file upload in the WP REST API FNS WordPress plugin (vivek2tamrakar) through version 1.0.0 allows remote unauthenticated attackers to upload web shells and achieve full server compromise. The CVSS 10.0 score reflects network-reachable, no-authentication exploitation with scope change and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS sits at 0.80% (74th percentile) indicating moderate but not yet high exploitation likelihood.
Authentication bypass in the WP REST API FNS WordPress plugin (versions up to and including 1.0.0) allows remote unauthenticated attackers to access protected functionality by leveraging an alternate path or channel that circumvents authentication checks. With a CVSS of 9.8 and EPSS at 54.50% (98th percentile), this vulnerability presents substantial exploitation risk, though no public exploit identified at time of analysis. The flaw maps to CWE-288 and was reported by Patchstack.
Unrestricted file upload in the WP REST API FNS WordPress plugin (vivek2tamrakar) through version 1.0.0 allows remote unauthenticated attackers to upload web shells and achieve full server compromise. The CVSS 10.0 score reflects network-reachable, no-authentication exploitation with scope change and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and EPSS sits at 0.80% (74th percentile) indicating moderate but not yet high exploitation likelihood.
Authentication bypass in the WP REST API FNS WordPress plugin (versions up to and including 1.0.0) allows remote unauthenticated attackers to access protected functionality by leveraging an alternate path or channel that circumvents authentication checks. With a CVSS of 9.8 and EPSS at 54.50% (98th percentile), this vulnerability presents substantial exploitation risk, though no public exploit identified at time of analysis. The flaw maps to CWE-288 and was reported by Patchstack.