Threats tagged 'ghsa-vv9m-j58m-3hwg'

The Advance Guest Post WordPress plugin up to version 1.9 contains a vulnerability that allows unauthenticated users to upload arbitrary PHP files due to improper file upload validation and a nonce exposed to all front-end visitors. This enables remote code execution on sites running PHP 7.x. The vulnerability does not affect PHP 8.0 and later, where the vulnerable code path triggers a fatal error before file upload completion.