DesignThemes Core Features WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Arbitrary File Read

A vulnerability exists in the DesignThemes Core Features plugin for WordPress, in all versions through 4.7. The issue arises from a missing capability check in the 'dt_process_imported_file' function, allowing unauthenticated attackers to read arbitrary files from the underlying operating system.

Impact

Exploitation of this vulnerability could lead to unauthorized access and reading of sensitive files on the server's file system.

Remediation

Users are advised to update the DesignThemes Core Features plugin to version 4.8 or a newer patched version.