Arbitrary File Upload Vulnerability in WPBakery Page Builder

CVE-2023-6925

What is CVE-2023-6925?

The Unlimited Addons for WPBakery Page Builder plugin for WordPress is affected by a serious vulnerability that allows authenticated users to conduct arbitrary file uploads. This security flaw arises from insufficient validation of file types in the 'importZipFile' function. Attackers with roles granted access by the administrator, including the default editor role and possibly contributors, can exploit this weakness to upload unauthorized files on the server, which could potentially enable remote code execution. Websites utilizing this plugin should review their access controls and apply necessary mitigations promptly to reduce the risk of exploitation.

References