HTTP: WordPress Spellchecker Plugin File Parameter File Inclusion

This signature detects attempts to exploit a known local and remote file inclusion vulnerabilities in Wordpress. It is due to insufficient validation of user-supplied input in Spellchecker plugin. A remote attacker can exploit this by enticing a target to open a malicious URL link. A successful attack can result in arbitrary code execution and loss of sensitive information.

Extended Description

The Spellchecker plugin for WordPress is prone to a local file-include vulnerability and a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible. Spellchecker 3.1 is vulnerable; other versions may also be affected.

Affected Products

Wordpress spellchecker

References

BugTraq: 47317

URL: http://www.wordpress.org/extend/plugins/spell-checker/ http://www.wordpress.org

Short Name

HTTP:PHP:WORDPRESS-SPELCHECK-FI

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: WordPress Spellchecker Plugin File Parameter File Inclusion

Extended Description

Affected Products

References

Found a potential security threat?