CVE-2025-0764
CVE-2025-0764
Título es
CVE-2025-0764
Vie, 28/02/2025 – 07:15
Tipo
CWE-20
Gravedad 2.0 Txt
Pendiente de análisis
Título en
CVE-2025-0764
Descripción en
The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of the 'Members' class in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with subscriber-level privileges or higher, to read arbitrary files on the server.
28/02/2025
28/02/2025
Vector CVSS:3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Gravedad 3.1 (CVSS 3.1 Base Score)
6.50
Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
MEDIUM
Referencias
https://plugins.trac.wordpress.org/changeset/3245711/wpforo
https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd8ffcb-0a24-4e0a-a9f9-23501742715f?source=cve
Enviar en el boletín
Off
