CVE-2015-8351: Code Injection
PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allowurlinclude is enabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8351?
CVE-2015-8351 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2015-8351?
To fix CVE-2015-8351, update the Gwolle Guestbook plugin to version 1.5.4 or later.
Who is affected by CVE-2015-8351?
WordPress sites using versions of the Gwolle Guestbook plugin prior to 1.5.4 are affected by CVE-2015-8351.
Can CVE-2015-8351 be exploited remotely?
Yes, CVE-2015-8351 can be exploited remotely by authenticated users who can craft a malicious URL.
What versions of Gwolle Guestbook are vulnerable to CVE-2015-8351?
Versions of the Gwolle Guestbook plugin before 1.5.4 are vulnerable to CVE-2015-8351.