Threats tagged 'ghsa-25hp-5jq6-x8fq'

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a vulnerability allowing authenticated users with subscriber-level access or higher to upload arbitrary files due to missing file type validation in the insert_media_attachment() function. This flaw exists in all versions up to and including 3.3.0. Exploitation could lead to remote code execution on the affected server.