Threats tagged 'ghsa-fjhx-3cm7-whvf'

The Extensions For CF7 plugin for WordPress, versions up to and including 3.4.5, contains an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files due to insufficient validation of file extensions, MIME types, and file sizes in the signature field. Additionally, the plugin lacks PHP execution restrictions in the upload directory and has a bypass in sanitize_file_name() that enables malicious file names to be accepted. Exploitation can lead to remote code execution.