medium5.0Public exploit code
CVE-2009-4170
WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin WP-Cumulus 1.20 - Full Path Disclosure / Cross-Site Scripting2009-11-25 · webapps · php · Verified
Impact
WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Roytanck | Wp-Cumulus | Version 1.20 |