WordPress Pixabay Images Plugin 'admin-ajax.php' Directory Traversal Vulnerability

Bugtraq ID:	73079
Class:	Input Validation Error
CVE:	CVE-2015-1365
Remote:	Yes
Local:	No
Published:	Feb 27 2015 12:00AM
Updated:	Feb 27 2015 12:00AM
Credit:	Hans-Martin Muench
Vulnerable:	WordPress Pixabay Images 2.3
Not Vulnerable:	WordPress Pixabay Images 2.4

WordPress Pixabay Images Plugin 'admin-ajax.php' Directory Traversal Vulnerability

The Pixabay Images plugin for WordPress is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to write an arbitrary file within the context of the web server. Information harvested may aid in launching further attacks.

Versions prior to Pixabay Images 2.4 are vulnerable.

WordPress Pixabay Images Plugin 'admin-ajax.php' Directory Traversal Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WordPress Pixabay Images Plugin 'admin-ajax.php' Directory Traversal Vulnerability

References:

• MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities (Hans-Martin Muench)
  
• Pixabay Images Wordpress Page (WordPress)
  
• WordPress HomePage (WordPress)