Threats tagged 'ghsa-8f9m-hfq9-wjxw'

The Pie Forms for WP WordPress plugin versions up to and including 1.6 contain an arbitrary file upload vulnerability. This flaw arises from insufficient validation of file types in the format_classic function, allowing unauthenticated attackers to upload files with dangerous extensions such as PHP. Although file names are generated using a secure hash and the upload directory is somewhat predictable, these factors limit but do not eliminate the risk of remote code execution.