WordPress versions prior to 6.4.3 and certain earlier versions are vulnerable to a PHP file upload bypass via the plugin installer. An administrative user can upload a file of a type other than zip on the Add New Plugin screen. If FTP credentials are requested for installation, the uploaded file remains temporarily available in the Media Library despite restrictions. When the DISALLOW_FILE_EDIT constant is true and FTP credentials are required, this can lead to remote code execution by an administrator who otherwise would not have the ability to execute arbitrary PHP code. The vulnerability only affects Administrator or Super Admin users on single or multisite installations respectively, and does not affect lower privilege users or sites with DISALLOW_FILE_MODS set to true. The issue was fixed in WordPress 6.4.3 and backported to multiple earlier versions.

This vulnerability allows an attacker with Administrator or Super Admin privileges to bypass file upload restrictions and potentially execute arbitrary PHP code remotely, leading to remote code execution. This elevates the risk on affected WordPress sites by enabling code execution where it would otherwise be restricted. Lower privilege users are not affected, and sites with DISALLOW_FILE_MODS set to true or where FTP credentials are not required or accessible are not vulnerable.

A fix is available and has been applied in WordPress version 6.4.3 and backported to many earlier versions. Site administrators should upgrade to one of these fixed versions. As a workaround, setting the DISALLOW_FILE_MODS constant to true will prevent any plugin uploads and thus mitigate the vulnerability. Sites where FTP credentials are not requested or are accessible to the administrator are not affected. No additional action is required if the site is already configured with DISALLOW_FILE_MODS=true.