CVE-2017-16871

HIGH

UpdraftPlus < 1.13.12 - Authenticated Remote Code Execution via Race Condition in plupload_action

Title source: llm

Description

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/LoRexxar/CVE_Request/tree/master/wordpress%20plugin%20updraftplus%20vulnerablity#authenticated--upload-file-and-php-code-execution

Scores

CVSS v3 8.1

EPSS 0.0165

EPSS Percentile 73.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-94

Status published

Products (1)

updraftplus/updraftplus < 1.13.12

Published Nov 17, 2017

Tracked Since Feb 18, 2026