WordPress MStore API Arbitrary File Upload Vulnerability Allowing Remote Code Execution

An arbitrary file upload vulnerability has been identified in WordPress MStore API version 2.0.6. This vulnerability allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can exploit this issue by uploading PHP files with arbitrary names to the 'config_file' endpoint, potentially leading to remote code execution on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which can be used to execute malicious code on the server, leading to remote code execution.

Reproduction

To reproduce this vulnerability, send a POST request to the '/wp-json/api/flutter_woo/config_file' endpoint with a file upload that includes a PHP file disguised as a JSON file. The uploaded file can then be executed on the server, achieving remote code execution.