Log in Start free

Vulnerability · Published Aug 24, 2020 · Assigned by mitre

CVE-2020-24186

Critical 10.0

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 94.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)94.6%top 0.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling3Metasploit, Nuclei, Public PoC

Official description

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References