Threats tagged 'ghsa-8ff8-c7j7-c996'

The Gravity Forms plugin for WordPress contains a critical vulnerability in the copy_post_image() function that allows unauthenticated attackers to upload arbitrary files due to missing file type validation. This affects all versions up to and including 2.9.20. Exploitation requires the site to have allow_url_fopen enabled, the post creation form active, and a file upload field present. Successful exploitation may lead to remote code execution on the affected server.