CVE-2020-12675

Published: May 29, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.

Affected (1)

Products: Mappresspro: Mappress

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mappresspro Mappress	Before 2.54.6

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://blog.alertlogic.com/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress/

Source: cve@mitre.org

Third Party Advisory

https://wordpress.org/plugins/mappress-google-maps-for-wordpress/#developers

Source: cve@mitre.org

Product

https://blog.alertlogic.com/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://wordpress.org/plugins/mappress-google-maps-for-wordpress/#developers

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.