Threats tagged 'ghsa-f7xh-xqh9-8g38'

The mView 豆瓣电影 WordPress plugin up to version 1.0.3 allows any authenticated user, including subscribers, to upload arbitrary PHP files without validating the file type, name, or source. This lack of validation and authorization checks enables remote code execution by saving malicious files to a web-accessible directory.