WordPress Smart Product Review Plugin Arbitrary File Upload Vulnerability
Vulnerability
A vulnerability allowing arbitrary file uploads has been identified in the WordPress Smart Product Review plugin, affecting all versions through 1.0.4. The issue arises from inadequate file type validation, enabling unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.
Impact
Exploitation of this vulnerability allows for arbitrary file uploads, which could be used to execute malicious code on the server.
Reproduction
The vulnerability can be reproduced by sending a POST request to '/wp-admin/admin-ajax.php' with the 'action' parameter set to 'sprw_file_upload_action'. The request must include a file in the 'files[]' parameter, along with additional data specifying the allowed file extensions and a nonce for verification.
Remediation
Users are advised to update the Smart Product Review plugin to version 1.0.5 or a newer patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.