Gwolle Guestbook, CVE-2015-8351

CVE, Research URL: CVE-2015-8351
Home page URL: Security reports for Gwolle Guestbook
Application: Gwolle Guestbook
Published on: Sep 12, 2017
Research Description: PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allow_url_include is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences regardless of whether allow_url_include is enabled.
Affected versions: Min -, max 2.1.1.
Status: vulnerable