Threats tagged 'ghsa-qrwx-hpgq-g68q'

The Innovative Form Builder – IvyForms plugin for WordPress versions up to 1.5.1 contains an arbitrary file upload vulnerability. This flaw arises from insufficient file type validation and deliberate override of WordPress's native MIME and extension checks, allowing authenticated users with custom-level access to upload potentially executable files. Attackers can configure a form to accept dangerous file extensions like PHP, enabling unauthenticated users to upload malicious files via a public REST endpoint, potentially leading to remote code execution.