CVE-2020-35945 - An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress

Back Back to CVE browser

CRITICAL

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress

Published Jan 1, 2021

9.9

CRITICAL

CVSS 3.1

EPSS 2.45%

Description

An issue was discovered in the Divi Builder plugin, Divi theme, and Divi Extra theme before 4.5.3 for WordPress. Authenticated attackers, with contributor-level or above capabilities, can upload arbitrary files, including .php files. This occurs because the check for file extensions is on the client side.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23528
Advisory
https://wpscan.com/vulnerability/10342
x_refsource_MISCBroken LinkExploitThird Party Advisory
https://www.wordfence.com/blog/2020/08/critical-vulnerability-exposes-over-700000-sites-using-divi-extra-and-divi-builder/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23528		Advisory
https://wpscan.com/vulnerability/10342		x_refsource_MISCBroken LinkExploitThird Party Advisory
https://www.wordfence.com/blog/2020/08/critical-vulnerability-exposes-over-700000-sites-using-divi-extra-and-divi-builder/		x_refsource_MISCExploitThird Party Advisory