Threats tagged 'ghsa-4q33-hxxp-g76m'

The RESTful Content Syndication plugin for WordPress versions 1.1.0 through 1.5.0 contains a vulnerability that allows authenticated users with Author-level access or higher to upload arbitrary files due to missing file type validation in the ingest_image() function. Exploitation requires access to a configured third-party server, making it less likely for contributor-level users to exploit. Successful exploitation could lead to remote code execution on the affected site.