WordPress Plugins and Themes Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing arbitrary file uploads has been identified in multiple WordPress plugins and themes. This issue arises from a missing capability check in the ajaxUploadFonts() function, affecting various versions. Authenticated attackers with Subscriber-level access and above can exploit this vulnerability to upload files that may lead to remote code execution. While this issue was partially patched, it remains exploitable.

Impact

Exploitation of this vulnerability allows authenticated users to upload arbitrary files, potentially leading to remote code execution.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected software.