Threats tagged 'ghsa-rqj9-6qp6-c345'

The Advance Guest Post WordPress plugin versions through 1.9 improperly validate uploaded files by using a case-sensitive and incomplete extension check. This flaw allows unauthenticated users to bypass validation and upload arbitrary files, including executable PHP variants, to a web-accessible directory. Depending on the server configuration, this can lead to remote code execution.