Threats tagged 'ghsa-hc8x-8wg2-9c9p'

The WP Ultimate CSV Importer WordPress plugin versions before 9.2 contain a vulnerability that allows an Administrator of a Multisite subsite to write and execute arbitrary PHP code in the shared WordPress context. This occurs because the plugin does not restrict the destination filename and extension nor validate the fetched content type when importing remote media. This flaw enables privilege escalation within a multisite environment despite the attacker not being a Network Administrator or having the ability to install or edit plugin files.