Threats tagged 'ghsa-g7h8-64g3-rpm4'

The Bit Flows plugin for WordPress up to version 1.31.0 is vulnerable to a Local File Inclusion (LFI) flaw via the 'image' parameter used by the ImageHelper node. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server if certain webhook configurations are in place, potentially leading to code execution or access control bypass. Exploitation requires an administrator to have configured a webhook-triggered flow using the vulnerable node without additional security controls like bearer secrets or IP allowlists.