Threats tagged 'ghsa-9jpw-f7gq-pv94'

The Gravity Forms plugin for WordPress up to version 2.9.21.1 contains a vulnerability in its legacy chunked upload mechanism that allows unauthenticated attackers to upload arbitrary .phar files due to missing file type validation. This flaw arises because the extension blacklist does not include .phar files. If the web server is configured to process .phar files as PHP, attackers can achieve remote code execution by discovering or enumerating the upload path.