Security News > 2020 > July > Critical Security Flaw in WordPress Plugin Allows RCE
Researchers are warning of a critical vulnerability in a WordPress plugin called Comments - wpDiscuz, which is installed on more than 70,000 websites.
The flaw gives unauthenticated attackers the ability to upload arbitrary files and ultimately execute remote code on vulnerable website servers.
The implementation of this feature lacked security protections vetting file attachments in the comments to make sure they actually are image files, versus another type of file.
To pass the file content-verification check, an attacker would simply need to add an image to make any file look like the allowed file type.
Earlier in July, it was discovered that the Adning Advertising plugin for WordPress, a premium plugin with over 8,000 customers, contains a critical remote code-execution vulnerability with the potential to be exploited by unauthenticated attackers.
News URL
https://threatpost.com/critical-rce-flaw-wordpress-plugin-on-70k-sites/157824/
Related news
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks (source)
- Critical Flaws in WGS-804HPT Switches Enable RCE and Network Exploitation (source)
- Critical zero-days impact premium WordPress real estate plugins (source)
- Critical Cacti Security Flaw (CVE-2025-22604) Enables Remote Code Execution (source)
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Don't Overlook These 6 Critical Okta Security Configurations (source)
- 89% of Enterprise GenAI Usage Is Invisible to Organizations Exposing Critical Security Risks, New Report Reveals (source)