BaseFortify

Executive Summary

This vulnerability is in the Easy DragDrop File Uploader WordPress plugin before version 1.1.10. It allows unauthenticated users to delete arbitrary files on the server by exploiting improper validation of user-supplied file paths. This includes critical files like wp-config.php.

Useful 0 Not Useful 0

Detection Guidance

Check if the Easy DragDrop File Uploader plugin is installed and verify its version. If it is below 1.1.10, the system is vulnerable. Look for unauthorized file deletions or suspicious activity logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could delete important files on your server, including configuration files like wp-config.php. This could lead to website downtime, data loss, or complete compromise of the WordPress site.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Easy DragDrop File Uploader plugin to version 1.1.10 or later immediately. Remove the plugin if not essential. Review server logs for signs of exploitation and restrict file deletion permissions.

Useful 0 Not Useful 0