CVE-2020-24186

CRITICAL 10.0CVE-2020-24186 · Published 24/08/2020 · updated 17/06/2026

Package	Affected versions	Patched versions
wpdiscuz gvectors	`≥ 7.0, ≤ 7.0.4`	No fix yet

Description

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

References

packetstormsecurity.com/files/162983/WordPress-wpDiscuz-7.0.4-Shell-Upload.html · Exploit
packetstormsecurity.com/files/163012/WordPress-wpDiscuz-7.0.4-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/163302/WordPress-wpDiscuz-7.0.4-Shell-Upload.html · Exploit
wordfence.com/blog/2020/07/critical-arbitrary-file-upload-vulnerability-patched-in-wpdiscuz-plugin · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free