Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.8epss 1.0%
from disclosure to weapon0 days
Published on NVDJul 22
metasploitOct 10
exploitation probability
1.0%top 41% of all CVEs
observed exploitation
nono source reports it
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Ajax Load More