Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wp_symposium | Wpsymposium | * | 11.12.08 (including) |
| Wp_symposium | Wpsymposium | 11.9.10 (including) | 11.9.10 (including) |
| Wp_symposium | Wpsymposium | 11.9.14 (including) | 11.9.14 (including) |
| Wp_symposium | Wpsymposium | 11.9.17 (including) | 11.9.17 (including) |
| Wp_symposium | Wpsymposium | 11.9.24 (including) | 11.9.24 (including) |
| Wp_symposium | Wpsymposium | 11.10.1 (including) | 11.10.1 (including) |
| Wp_symposium | Wpsymposium | 11.10.8 (including) | 11.10.8 (including) |
| Wp_symposium | Wpsymposium | 11.10.15 (including) | 11.10.15 (including) |
| Wp_symposium | Wpsymposium | 11.10.22 (including) | 11.10.22 (including) |
| Wp_symposium | Wpsymposium | 11.10.29 (including) | 11.10.29 (including) |
| Wp_symposium | Wpsymposium | 11.11.5 (including) | 11.11.5 (including) |
| Wp_symposium | Wpsymposium | 11.11.12 (including) | 11.11.12 (including) |
| Wp_symposium | Wpsymposium | 11.11.19 (including) | 11.11.19 (including) |
| Wp_symposium | Wpsymposium | 11.11.26 (including) | 11.11.26 (including) |
| Wp_symposium | Wpsymposium | 11.12.03 (including) | 11.12.03 (including) |