nixtainternet

All including current

Versions-Affected:<= 5.13.2

Type:Upload

Severity:High

Is Fixed Version Available:No

Description:The AdRotate Banner Manager – The only ad manager you’ll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2.

This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site’s server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.

any other way to contact you aside slack?
whatsapp?
email?

Im not sure it needs to be modded – or does it ?

i simply want, 4 locations, zero stock control and the front end customer totally unaware

is this something thats needs to be modified?

Yes the issues persists all my users are members.
this has only just happened with the upgrade, parts of the site that were previously hidden to various levels, rules are being ignored and its being shown to all members , for example :-

big digital download banner for arcadesystems , the custom code originally says :-

[membership level=”0,7″]
<img src=”……..
[/membership]

This was working perfectly before the 3.0 version, now EVERYONE see this image including all other levels of users. Its simply being ignored.

here

also worth noting that the shortcode that was in the widgets no longer work either example : [membership level=”0,7″]

Anyways to downgrade this ?

this was working fine until the 3.0 upgrade….

health check plugin reports all as good – warns me of an inactive plugin but everything else all good

The site is live – I did disable lots of plugins, but the only time it did it was when I disabled this plugin – I have just reenabled the plugin and there is a small pause between posts/pages in back end loading now – but they are loading, but there is definitely something suspect for the pause (couple of seconds)

No values set for: bsp_settings_admin

attached

https://imgur.com/a/NQH95DS

• This reply was modified 1 year ago by nixtainternet.
• This reply was modified 1 year ago by nixtainternet.

no, my bad its actually the <pre> code rather than <quote> code on that page – you can see its white on white

Thank you ??

looking at it , it could be “pre” as i can see how to change quotes now ??

preformat background , how to change color ?

I am logged in – support wont assist – emailed them before posting here