title: 3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload
description: The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
vendor: Unknown
product: 3DPrint Lite
versions:
status: affected, versionType: semver, version: 0, lessThan: 1.9.1.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}