WordPress Plugin Vulnerable to Arbitrary File Upload Exploit

CVE-2024-6756

Summary

The Social Auto Poster plugin for WordPress is susceptible to an arbitrary file upload flaw due to inadequate file type validation in the 'wpw_auto_poster_get_image_path' function. This vulnerability affects all versions of the plugin up to and including 5.3.14. Authenticated attackers with Contributor role or higher can exploit this weakness to upload files to the server, potentially allowing the execution of arbitrary code. An additional vulnerability, CVE-2024-6754, may enable exploitation with subscriber-level access, further increasing the risk of a security breach.

References