Garden Gnome Package WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Garden Gnome Package plugin for WordPress, affecting all versions through 2.3.0. The issue arises from inadequate file type validation in the feature that automatically extracts 'ggpkg' files after they are uploaded. This flaw enables authenticated attackers with Author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution, depending on the nature of the uploaded files.

Remediation

Users are advised to update the Garden Gnome Package plugin to version 2.4.0 or a newer patched version.