Zarinpal Paid Download WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability exists in the Zarinpal Paid Download WordPress plugin, affecting versions through 2.3, due to improper validation of uploaded files. This flaw allows high-privilege users, such as administrators, to upload arbitrary files to the server, even in scenarios where such actions should be restricted, like in a multisite setup.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads on the server, potentially allowing for further attacks such as executing uploaded malicious files or causing a denial-of-service.