CVE-2018-17573: Smartlogix Wp-Insert

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

The Wp-Insert plugin through 2.4.2 for WordPress allows upload of arbitrary PHP code because of the exposure and configuration of FCKeditor under fckeditor/editor/filemanager/browser/default/browser.html, fckeditor/editor/filemanager/connectors/test.html, and fckeditor/editor/filemanager/connectors/uploadtest.html.

Affected products

• Smartlogix Wp-Insert: up to and including 2.4.2

Published 2018-09-28. Last modified 2026-06-17.