Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)

[Dave Warren <davew@xxxxxxxxxxxx>]

On 2014-04-29 05:13, Illwill wrote:
> What circumstance would a WordPress admin not usually have this kind of access 
> anyhow?

Although it's rarely used, WordPress does have the capability to support 
multiple levels of administrators, in which case one may have access to 
an already installed plugin, but not to install their own.

The same may be true if this plugin were installed in multiuser mode, 
although I haven't kept up on what is permitted in multiuser mode, or 
whether this plugin works in multiuser mode or not.

--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/