https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:47:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2024-12300 <p>The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It&#39;s important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.</p> <p>The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It&#39;s important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2024-12300 https://vulnerability.circl.lu/vuln/ghsa-697v-r35h-ff64 <p>The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It&#39;s important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.</p> <p>The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension attack. It&#39;s important to note the file is deleted immediately and double extension attacks only work on select servers making this unlikely to be successfully exploited.</p> https://vulnerability.circl.lu/vuln/ghsa-697v-r35h-ff64