Unauthorized Media Upload Vulnerability in The Post Form Plugin

CVE-2024-1169

Summary

The BuddyForms plugin for WordPress, which facilitates the creation of frontend content forms for user submissions, is exposed to a serious security flaw. Due to a missing capability check in the buddyforms_upload_handle_dropped_media function, all versions up to and including 2.8.7 are susceptible to unauthorized media uploads. This vulnerability allows unauthenticated attackers to exploit the upload function, potentially leading to further attacks or unauthorized access to the website. It is imperative for WordPress site administrators using this plugin to apply the necessary security updates and restrict user capabilities to mitigate the risk posed by this vulnerability.

References