Threats tagged 'ghsa-8pj6-v8j5-4mc5'

The WP Dropzone WordPress plugin versions up to and including 1.1.0 contain an authenticated arbitrary file upload vulnerability via the ajax_upload_handle function. This flaw arises because chunked uploads write files directly to the uploads directory before file type validation, allowing authenticated users with subscriber-level access or higher to upload arbitrary files. This may lead to remote code execution on the affected server.