Threats tagged 'ghsa-v278-3mjv-f38g'

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress contain an arbitrary file upload vulnerability in versions 2.0 through 3.8.3. This flaw allows authenticated users with subscriber-level access or higher to upload files without proper validation of file type or content. The vulnerability arises from the download_file_to_uploads function, which registers an import action for unauthenticated users and lacks capability checks and MIME type validation. This can lead to remote code execution if malicious executable files are uploaded.