The Astra Security Suite – Firewall & Malware Scan WordPress plugin contains an improper authorization vulnerability (CWE-285) that enables unauthenticated attackers to upload arbitrary files. This occurs because the plugin insufficiently validates remote URLs used for zip file downloads and uses an easily guessable key in versions up to 0.2. Exploitation could allow attackers to execute remote code on the affected server. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or mitigation guidance is currently available from the vendor.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the server hosting the vulnerable WordPress plugin, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.