SEUR Oficial, CVE-2021-25004

CVE, Research URL: CVE-2021-25004
Home page URL: Security reports for SEUR Oficial
Application: SEUR Oficial
Published on: Feb 07, 2022
Research Description: The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.
Affected versions: Min -, max 1.7.2.
Status: vulnerable