Arbitrary File Upload Vulnerability in AcyMailing Plugin

CVE-2024-7384

Summary

AcyMailing, the popular newsletter plugin for WordPress, has been identified with a vulnerability that allows authenticated attackers to upload arbitrary files to the server. This is due to inadequate file type validation in the acym_extractArchive function, affecting all versions up to and including 9.7.2. Attackers with Subscriber-level access or higher can exploit this flaw, potentially leading to remote code execution. Website administrators using the AcyMailing plugin should apply necessary updates and implement additional security measures to mitigate the risks associated with this vulnerability.

References