Threats tagged 'ghsa-gpw6-7fmv-fc4m'

The URL Image Importer plugin for WordPress up to version 1.0.6 suffers from an arbitrary file upload vulnerability. This occurs because the plugin relies on a user-controlled Content-Type HTTP header for file type validation, allowing authenticated users with Author-level access or higher to upload arbitrary files. The vulnerability may enable remote code execution if a malicious PHP file is uploaded.