Post Saint WordPress Plugin Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in the Post Saint WordPress plugin, specifically in versions through 1.3.1, allowing authenticated users with subscriber-level access and above to upload arbitrary files. This issue arises from a lack of proper capability checks and file type validation in the add_image_to_library AJAX action. The vulnerability could be exploited to execute remote code on the server.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, with the potential for remote code execution on the server.

Remediation

No known patch is available. Users are advised to uninstall the affected plugin and consider finding a replacement.