Unauthenticated Arbitrary File Copy in WP Webhooks

WP Webhooks up to 3.3.5 copies files using paths taken from request data without validating them. When a Contact Form 7 webhook preserves uploaded form files, an unauthenticated visitor can submit the form with crafted values and copy any readable file on the server, such as wp-config.php, to a web-accessible location, exposing the database... Weiterlesen: Unauthenticated Arbitrary File Copy in WP Webhooks