WP Foodbakery Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the WP Foodbakery plugin for WordPress, in versions through and including 4.7. This issue arises from inadequate validation of file types in the 'upload_publisher_profile_image' function. As a result, unauthenticated attackers can upload arbitrary files to the server hosting the affected site, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, which may be used to execute malicious code on the server.

Remediation

Users are advised to update the WP Foodbakery plugin to version 4.8 or a newer patched version.