WordPress Plugin WP Super Edit Unrestricted File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing unrestricted file upload has been identified in the WordPress plugin WP Super Edit, specifically in versions through 2.5.4. This issue arises within the FCKeditor component, where attackers can upload dangerous file types without proper validation. The vulnerability allows for arbitrary file uploads via the filemanager upload endpoint, potentially leading to remote code execution and complete system compromise.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which can be used to execute malicious code on the server, leading to a complete system compromise.

Reproduction

To reproduce this vulnerability, upload a file through the FCKeditor filemanager upload endpoint. The uploaded file can be accessed via the filemanager browser.