Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.9%
exploitation probability
1.9%top 22% of all CVEs
observed exploitation
nono source reports it
The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
Affected products
Unknown · Classyfrieds