CVE-2014-125102 (PHP, published 2023-05-29T23:15Z)
Description: value: A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.0.8 is able to address this issue. The identifier of the patch is 860d1891025548cf0f5f97364c1f51a888f523c3. It is recommended to upgrade the affected component. The identifier VDB-230113 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/wp-plugins/relevant
Files changed:
bws_menu/bws_menu.php
bws_menu/css/style.css
languages/related_posts_plugin-ru_RU.po
languages/related_posts_plugin-uk.po
readme.txt
related-posts-plugin.php
Commit message: V1.0.8 - Security Exploit was fixed. Ability to show posts thumbnails.

git-svn-id: https://plugins.svn.wordpress.org/relevant/trunk@962246 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
* Version: 1.3.2
				'description'	=> 'Allows you to celebrate liked the article.',
				'wp_install'	=> 'http://bestwebsoft.com/plugin/user-role/?k=dfe2244835c6fbf601523964b3f34ccc&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'description'	=> 'Allows you to celebrate liked the article.',
				$bwsmn_form_email = trim( $_REQUEST['bwsmn_form_email'] );
				if ( $bwsmn_form_email == "" || !preg_match( "/^((?:[a-z0-9']+(?:[a-z0-9\-_\.']+)?@[a-z0-9]+(?:[a-z0-9\-\.]+)?\.[a-z]{2,5})[, ]*)+$/i", $bwsmn_form_email ) ) {
				$message_text .= '</table>
				<h4>Active Plugins</h4>
				<table>';
				foreach ( $system_info['active_plugins'] as $key => $value ) {	
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
				$message_text .= '</table>
				<h4>Inactive Plugins</h4>
				<table>';
				foreach ( $system_info['inactive_plugins'] as $key => $value ) {
					$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
				$message_text .= '</table></body></html>';
										<span> | </span>
										<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
										<span> | </span>
										<a href="<?php echo $bws_plugins[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
						<?php foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
							<tr>
								<td scope="row"><?php echo $key; ?></td>
								<td scope="row"><?php echo $value; ?></td>
							</tr>	
						<?php } ?>
"POT-Creation-Date: 2013-12-25 19:23+0300\n"
"Last-Translator: BestWebSoft <support@bestwebsoft.com>\n"
#: related-posts-plugin.php:35
#: related-posts-plugin.php:300
#: related-posts-plugin.php:35
#: related-posts-plugin.php:180
#: related-posts-plugin.php:231
#: related-posts-plugin.php:243
#: related-posts-plugin.php:262
#: related-posts-plugin.php:56
msgid "<h2>Related Posts Plugin</h2>"
msgstr "<h2>Плагин Related Posts</h2>"

#: related-posts-plugin.php:57
msgid "<p>No related posts found...</p>"
msgstr "<p>Не найдено похожих записей...</p>"
#: related-posts-plugin.php:109
#: related-posts-plugin.php:109
#: related-posts-plugin.php:109
#: related-posts-plugin.php:109
#: related-posts-plugin.php:157
#: related-posts-plugin.php:169
#: related-posts-plugin.php:170
#: related-posts-plugin.php:171
#: related-posts-plugin.php:188
#: related-posts-plugin.php:190
#: related-posts-plugin.php:191
#: related-posts-plugin.php:234
#: related-posts-plugin.php:264
#: related-posts-plugin.php:283
#: related-posts-plugin.php:294
#: related-posts-plugin.php:302
#: related-posts-plugin.php:302
#: related-posts-plugin.php:306
#: related-posts-plugin.php:307
#: related-posts-plugin.php:312
#: related-posts-plugin.php:320
#: related-posts-plugin.php:328
#: related-posts-plugin.php:336
#: related-posts-plugin.php:341
#: related-posts-plugin.php:345
#: related-posts-plugin.php:349
#: related-posts-plugin.php:353
#: related-posts-plugin.php:356
#: related-posts-plugin.php:362
#: related-posts-plugin.php:368
#: related-posts-plugin.php:375
#: related-posts-plugin.php:382
#: related-posts-plugin.php:383
#: related-posts-plugin.php:386
"POT-Creation-Date: 2013-12-25 19:23+0300\n"
"Last-Translator: BestWebSoft <support@bestwebsoft.com>\n"
#: related-posts-plugin.php:35
#: related-posts-plugin.php:300
#: related-posts-plugin.php:35
#: related-posts-plugin.php:180
#: related-posts-plugin.php:231
#: related-posts-plugin.php:243
#: related-posts-plugin.php:262
#: related-posts-plugin.php:56
msgid "<h2>Related Posts Plugin</h2>"
msgstr "<h2>Плагін Related Posts</h2>"

#: related-posts-plugin.php:57
msgid "<p>No related posts found...</p>"
msgstr "<p>Не знайдено схожих записів...</p>"
#: related-posts-plugin.php:109
#: related-posts-plugin.php:109
#: related-posts-plugin.php:109
#: related-posts-plugin.php:109
#: related-posts-plugin.php:157
#: related-posts-plugin.php:169
#: related-posts-plugin.php:170
#: related-posts-plugin.php:171
#: related-posts-plugin.php:188
#: related-posts-plugin.php:190
#: related-posts-plugin.php:191
#: related-posts-plugin.php:234
#: related-posts-plugin.php:264
#: related-posts-plugin.php:283
#: related-posts-plugin.php:294
#: related-posts-plugin.php:302
#: related-posts-plugin.php:302
#: related-posts-plugin.php:306
#: related-posts-plugin.php:307
#: related-posts-plugin.php:312
#: related-posts-plugin.php:320
#: related-posts-plugin.php:328
#: related-posts-plugin.php:336
#: related-posts-plugin.php:341
#: related-posts-plugin.php:345
#: related-posts-plugin.php:349
#: related-posts-plugin.php:353
#: related-posts-plugin.php:356
#: related-posts-plugin.php:362
#: related-posts-plugin.php:368
#: related-posts-plugin.php:375
#: related-posts-plugin.php:382
#: related-posts-plugin.php:383
#: related-posts-plugin.php:386
Tested up to: 3.9.1
Stable tag: 1.0.7
Related Posts Plugin allows you to display related posts with similar words in category, tags, title or by adding special meta key for posts, and display list of the titles of these posts by the widget or by the shortcode.
* Budfix : Plugin optimization is done.
Version: 1.0.7
			'plugin_option_version'	=> $rltdpstsplgn_plugin_info["Version"],
			'criteria'		=>	'category',
			'number_post'	=>	'5',
			'head'			=>	__( '<h2>Related Posts Plugin</h2>', 'related_posts_plugin' ),
			'no_posts'		=>	__( '<p>No related posts found...</p>', 'related_posts_plugin' ),
			'index_show'	=>	0
			echo $rltdpstsplgn_options['head'];
			$rltdpstsplgn_options = $_POST['rltdpstsplgn_options'];
			//$rltdpstsplgn_options['plugin_option_version']	= $rltdpstsplgn_plugin_info["Version"];
				if ( ! isset( $_POST['rltdpstsplgn_options']['index_show'] ) ) {
					$rltdpstsplgn_options['index_show'] = 0;
				}
							<th>
								<label><?php _e( 'Heading the list of related posts:', 'related_posts_plugin' ); ?>&nbsp;</label>
							</th>
								<input class="rltdpstsplgn_text" type="text" name="rltdpstsplgn_options[head]" value="<?php echo $rltdpstsplgn_options['head'] ?>" />
							<th>
								<label><?php _e( 'How many posts to displa y:', 'related_posts_plugin' ); ?>&nbsp;</label>
							</th>
								<input id="rltdpstsplgn_number" type="number" name="rltdpstsplgn_options[number_post]" value="<?php echo $rltdpstsplgn_options['number_post'] ?>"/>
							<th>
								<label><?php _e( 'Message if do not have related posts:', 'related_posts_plugin' ); ?></label>
							</th>
								<input class="rltdpstsplgn_text" type="text" name="rltdpstsplgn_options[no_posts]" value="<?php echo $rltdpstsplgn_options['no_posts'] ?>" />
							<th>
								<?php _e( 'Select an option on which will be searched for related words in the posts:', 'related_posts_plugin' ); ?>
							</th>
							<th>
								<?php _e( 'Show Related Posts Widget not only in the post (category/tag/index/home page)', 'related_posts_plugin' ); ?>
							</th>
					echo '<div class="rltdpstsplgn_content">';
					echo '<h3><a href="' .  get_permalink( get_the_ID() ) . '">';
					the_title();
					echo '</a></h3>';
				echo $rltdpstsplgn_options['no_posts'];
			echo $rltdpstsplgn_options['no_posts'];

Fixed code:
* Version: 1.3.7
				'description'	=> 'Allows you to see how many times your page has been liked on Google Search Engine as well as who has liked the article.',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=User+Role+BestWebSoft&plugin-search-input=Search+Plugins',
			),
			'email-queue/email-queue.php' => array(
				'name'			=> 'Email Queue',
				'description'	=> 'Allows to manage email massages sent by BestWebSoft plugins.',
				'link'			=> 'http://bestwebsoft.com/plugin/email-queue/?k=e345e1b6623f0dca119bc2d9433b130b&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'download'		=> 'http://bestwebsoft.com/plugin/email-queue/?k=e345e1b6623f0dca119bc2d9433b130b&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=Email+Queue+BestWebSoft&plugin-search-input=Search+Plugins',
				'settings'		=> 'admin.php?page=mlq_settings'
			),
			'limit-attempts/limit-attempts.php' => array(
				'name'			=> 'Limit Attempts',
				'description'	=> 'Allows you to limit rate of login attempts by the ip, and create whitelist and blacklist.',
				'link'			=> 'http://bestwebsoft.com/plugin/limit-attempts/?k=b14e1697ee4d008abcd4bd34d492573a&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'download'		=> 'http://bestwebsoft.com/plugin/limit-attempts/?k=b14e1697ee4d008abcd4bd34d492573a&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&s=Limit+Attempts+BestWebSoft&plugin-search-input=Search+Plugins',
				'settings'		=> 'admin.php?page=limit-attempts.php',
				'pro_version'	=> 'limit-attempts-pro/limit-attempts-pro.php'
			),
			'job-board/job-board.php' => array(
				'name'			=> 'Job board',
				'description'	=> 'Allows to create a job-board page on your site.',
				'link'			=> 'http://bestwebsoft.com/plugin/job-board/?k=b0c504c9ce6edd6692e04222af3fed6f&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'download'		=> 'http://bestwebsoft.com/plugin/job-board/?k=b0c504c9ce6edd6692e04222af3fed6f&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#download',
				'wp_install'	=> '/wp-admin/plugin-install.php?tab=search&type=term&s=Job+board+BestWebSoft&plugin-search-input=Search+Plugins',
				'settings'		=> 'admin.php?page=job-board.php'
				'description'	=> 'Allows you to see how many times your page has been liked on Google Search Engine as well as who has liked the article.',
			),
			'limit-attempts-pro/limit-attempts-pro.php' => array(
				'name'			=> 'Limit Attempts Pro',
				'description'	=> 'Allows you to limit rate of login attempts by the ip, and create whitelist and blacklist.',
				'link'			=> 'http://bestwebsoft.com/plugin/limit-attempts-pro/?k=9d42cdf22c7fce2c4b6b447e6a2856e0&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version,
				'purchase' 		=> 'http://bestwebsoft.com/plugin/limit-attempts-pro/?k=9d42cdf22c7fce2c4b6b447e6a2856e0&pn=' . $bws_plugin_info["id"] . '&v=' . $bws_plugin_info["version"] . '&wp_v=' . $wp_version . '#purchase',
				'settings'		=> 'admin.php?page=limit-attempts-pro.php',
				$bwsmn_form_email = esc_html( trim( $_REQUEST['bwsmn_form_email'] ) );
				if ( $bwsmn_form_email == "" || ! is_email( $bwsmn_form_email ) ) {
				$message_text .= '</table>';
				if ( ! empty( $system_info['active_plugins'] ) ) {
					$message_text .= '<h4>Active Plugins</h4>
					<table>';
					foreach ( $system_info['active_plugins'] as $key => $value ) {	
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';	
					}
					$message_text .= '</table>';
				if ( ! empty( $system_info['inactive_plugins'] ) ) {
					$message_text .= '<h4>Inactive Plugins</h4>
					<table>';
					foreach ( $system_info['inactive_plugins'] as $key => $value ) {
						$message_text .= '<tr><td scope="row">'. $key .'</td><td scope="row">'. $value .'</td></tr>';
					}
					$message_text .= '</table>';
				$message_text .= '</body></html>';
										<?php if ( '' != $bws_plugins_pro[ $key_plugin ]["settings"] ) { ?>
											<span> | </span>
											<a href="<?php echo $bws_plugins_pro[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
										<?php } ?>
										<?php if ( '' != $bws_plugins[ $key_plugin ]["settings"] ) { ?>
											<span> | </span>
											<a href="<?php echo $bws_plugins[ $key_plugin ]["settings"]; ?>" target="_blank"><?php _e( "Settings", 'bestwebsoft' ); ?></a>
										<?php } ?>
						<?php if ( ! empty( $system_info['active_plugins'] ) ) {
							foreach ( $system_info['active_plugins'] as $key => $value ) { ?>	
								<tr>
									<td scope="row"><?php echo $key; ?></td>
									<td scope="row"><?php echo $value; ?></td>
								</tr>	
							<?php }
						} ?>
    line-height: 19px;
"POT-Creation-Date: 2014-08-08 10:42+0300\n"
"Last-Translator: bestwebsoft.com <plugins@bestwebsoft.com>\n"
#: related-posts-plugin.php:75
#: related-posts-plugin.php:336
#: related-posts-plugin.php:75
#: related-posts-plugin.php:117
#: related-posts-plugin.php:214
#: related-posts-plugin.php:265
#: related-posts-plugin.php:277
#: related-posts-plugin.php:296
#: related-posts-plugin.php:118
msgid "No related posts found..."
msgstr "Не найдено похожих записей..."
#: related-posts-plugin.php:167
#: related-posts-plugin.php:167
#: related-posts-plugin.php:167
#: related-posts-plugin.php:167
#: related-posts-plugin.php:191
#: related-posts-plugin.php:203
#: related-posts-plugin.php:338
#: related-posts-plugin.php:204
#: related-posts-plugin.php:339
#: related-posts-plugin.php:205
#: related-posts-plugin.php:222
#: related-posts-plugin.php:224
#: related-posts-plugin.php:225
#: related-posts-plugin.php:268
#: related-posts-plugin.php:298
#: related-posts-plugin.php:317
#: related-posts-plugin.php:330
#: related-posts-plugin.php:342
#: related-posts-plugin.php:342
#: related-posts-plugin.php:346
#: related-posts-plugin.php:347
#: related-posts-plugin.php:351
#: related-posts-plugin.php:359
#: related-posts-plugin.php:367
#: related-posts-plugin.php:375
#: related-posts-plugin.php:380
#: related-posts-plugin.php:384
#: related-posts-plugin.php:388
#: related-posts-plugin.php:392
#: related-posts-plugin.php:395
#: related-posts-plugin.php:401
#: related-posts-plugin.php:407
#: related-posts-plugin.php:412
msgid "Show posts thumbnails"
msgstr "Отображать эскизы постов"

#: related-posts-plugin.php:424
#: related-posts-plugin.php:430
#: related-posts-plugin.php:431
#: related-posts-plugin.php:434
#~ msgid "<h2>Related Posts Plugin</h2>"
#~ msgstr "<h2>Плагин Related Posts</h2>"
"POT-Creation-Date: 2014-08-08 10:42+0300\n"
"Last-Translator: bestwebsoft.com <plugins@bestwebsoft.com>\n"
#: related-posts-plugin.php:75
#: related-posts-plugin.php:336
#: related-posts-plugin.php:75
#: related-posts-plugin.php:117
#: related-posts-plugin.php:214
#: related-posts-plugin.php:265
#: related-posts-plugin.php:277
#: related-posts-plugin.php:296
#: related-posts-plugin.php:118
msgid "No related posts found..."
msgstr "Не знайдено схожих записів..."
#: related-posts-plugin.php:167
#: related-posts-plugin.php:167
#: related-posts-plugin.php:167
#: related-posts-plugin.php:167
#: related-posts-plugin.php:191
#: related-posts-plugin.php:203
#: related-posts-plugin.php:338
#: related-posts-plugin.php:204
#: related-posts-plugin.php:339
#: related-posts-plugin.php:205
#: related-posts-plugin.php:222
#: related-posts-plugin.php:224
#: related-posts-plugin.php:225
#: related-posts-plugin.php:268
#: related-posts-plugin.php:298
#: related-posts-plugin.php:317
#: related-posts-plugin.php:330
#: related-posts-plugin.php:342
#: related-posts-plugin.php:342
#: related-posts-plugin.php:346
#: related-posts-plugin.php:347
#: related-posts-plugin.php:351
#: related-posts-plugin.php:359
#: related-posts-plugin.php:367
#: related-posts-plugin.php:375
#: related-posts-plugin.php:380
#: related-posts-plugin.php:384
#: related-posts-plugin.php:388
#: related-posts-plugin.php:392
#: related-posts-plugin.php:395
#: related-posts-plugin.php:401
#: related-posts-plugin.php:407
#: related-posts-plugin.php:412
msgid "Show posts thumbnails"
msgstr ""

#: related-posts-plugin.php:424
#: related-posts-plugin.php:430
#: related-posts-plugin.php:431
#: related-posts-plugin.php:434
#~ msgid "<h2>Related Posts Plugin</h2>"
#~ msgstr "<h2>Плагін Related Posts</h2>"
Tested up to: 3.9.2
Stable tag: 1.0.8
Related Posts Plugin allows to display a list of post titles by the widget or by the shortcode. It displays related posts with similar words in category, tags, title or by adding special meta key for posts. Related Posts Plugin is simple to use and to customize - this is what you are looking for.
= V1.0.8 - 07.08.2014 =
* Bugfix : Security Exploit was fixed.
* NEW : Ability to show posts thumbnails.

* Bugfix : Plugin optimization is done.
= V1.0.8 =
Security Exploit was fixed. Ability to show posts thumbnails.

Version: 1.0.8
			'plugin_option_version'	=>	$rltdpstsplgn_plugin_info["Version"],
			'criteria'				=>	'category',
			'number_post'			=>	'5',
			'head'					=>	__( 'Related Posts Plugin', 'related_posts_plugin' ),
			'no_posts'				=>	__( 'No related posts found...', 'related_posts_plugin' ),
			'index_show'			=>	0,
			'show_thumbnail'		=>	0
			echo '<h2>' . strip_tags( $rltdpstsplgn_options['head'] ) . '</h2>';
			foreach ( $_POST['rltdpstsplgn_options'] as $key => $value ) {
				$rltdpstsplgn_options[ $key ] = stripslashes( esc_html( $_POST['rltdpstsplgn_options'][ $key ] ) );
			}
				$rltdpstsplgn_options['index_show'] = isset( $_POST['rltdpstsplgn_options']['index_show'] ) ? 1 : 0;
				$rltdpstsplgn_options['show_thumbnail'] = isset( $_POST['rltdpstsplgn_options']['show_thumbnail'] ) ? 1 : 0;
							<th><?php _e( 'Heading the list of related posts:', 'related_posts_plugin' ); ?></th>
								<input class="rltdpstsplgn_text" type="text" name="rltdpstsplgn_options[head]" value="<?php echo strip_tags( $rltdpstsplgn_options['head'] ); ?>" />
							<th><?php _e( 'How many posts to display:', 'related_posts_plugin' ); ?></th>
								<input id="rltdpstsplgn_number" type="number" name="rltdpstsplgn_options[number_post]" value="<?php echo $rltdpstsplgn_options['number_post']; ?>" min="1" />
							<th><?php _e( 'Message if do not have related posts:', 'related_posts_plugin' ); ?></th>
								<input class="rltdpstsplgn_text" type="text" name="rltdpstsplgn_options[no_posts]" value="<?php echo strip_tags( $rltdpstsplgn_options['no_posts'] ); ?>" />
							<th><?php _e( 'Select an option on which will be searched for related words in the posts:', 'related_posts_plugin' ); ?></th>
							<th><?php _e( 'Show Related Posts Widget not only in the post (category/tag/index/home page)', 'related_posts_plugin' ); ?></th>
						<tr>
							<th><?php _e( 'Show posts thumbnails', 'related_posts_plugin' ); ?></th>
							<td>
								<label>
									<input class="rltdpstsplgn_text" type="checkbox" name="rltdpstsplgn_options[show_thumbnail]" value="1" <?php checked( $rltdpstsplgn_options['show_thumbnail'], 1 ); ?> />
								</label>
							</td>
						</tr>
					echo '<div class="rltdpstsplgn_content">';					
					echo '<a href="' .  get_permalink( get_the_ID() ) . '"><h3>' . get_the_title() . '</h3>';
					if ( 1 == $rltdpstsplgn_options['show_thumbnail'] && has_post_thumbnail( get_the_ID() ) )
						echo get_the_post_thumbnail( get_the_ID(), 'thumbnail' );
					echo '</a>';
				echo '<p>' . strip_tags( $rltdpstsplgn_options['no_posts'] ) . '</p>';
			echo '<p>' . strip_tags( $rltdpstsplgn_options['no_posts'] ) . '</p>';