| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 29 Apr 2014 13:40:35 -0700 From: Dave Warren <davew@...eahit.com> To: Illwill <illwill@...mob.org>, fulldisclosure@...lists.org Subject: Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin) On 2014-04-29 05:13, Illwill wrote: > What circumstance would a WordPress admin not usually have this kind of access anyhow? Although it's rarely used, WordPress does have the capability to support multiple levels of administrators, in which case one may have access to an already installed plugin, but not to install their own. The same may be true if this plugin were installed in multiuser mode, although I haven't kept up on what is permitted in multiuser mode, or whether this plugin works in multiuser mode or not. -- Dave Warren http://www.hireahit.com/ http://ca.linkedin.com/in/davejwarren _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists