WordPress Plugin U Extended Comment 'fileurl' Parameter Arbitrary File Download (1.0.1)
Description
WordPress Plugin U Extended Comment is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently verify user-supplied input. An attacker can exploit this issue to gain access to sensitive information which may lead to other attacks. Successful exploitation requires "Attachment" permissions. WordPress Plugin U Extended Comment version 1.0.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.0.2 or latest