CVE-2013-1949 | Vulnerability Database | Aqua Security

Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.

Affected Software

Name	Vendor	Start Version	End Version
Social-media-widget	Blinkwebeffects	4.0 (including)	4.0 (including)

References

http://blog.sucuri.net/2013/04/wordpress-plugin-social-media-widget.html
http://it.slashdot.org/story/13/04/13/212226/popular-wordpress-plug-in-caught-spamming-is-put-on-probation
http://securityledger.com/hacked-wordpress-plug-in-put-on-double-secret-probation/
http://www.openwall.com/lists/oss-security/2013/04/14/1
http://blog.sucuri.net/2013/04/wordpress-plugin-social-media-widget.html
http://it.slashdot.org/story/13/04/13/212226/popular-wordpress-plug-in-caught-spamming-is-put-on-probation
http://securityledger.com/hacked-wordpress-plug-in-put-on-double-secret-probation/
http://www.openwall.com/lists/oss-security/2013/04/14/1

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-1949
CWE	https://cwe.mitre.org/data/definitions/.html