high7.5Public exploit code
CVE-2012-3814
Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Font Uploader 1.2.4 - Arbitrary File Upload2012-06-06 · webapps · php · Verified
Impact
Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pippin Williamson | Font Uploader | Version 1.2.4 |