Aiomatic WordPress Plugin Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability exists in the Aiomatic WordPress plugin, specifically in the 'aiomatic_generate_featured_image' function, all versions through 2.3.8. The issue arises from inadequate file type validation, allowing authenticated users with Contributor-level access or higher to upload arbitrary files to the server. This could potentially lead to remote code execution.

Impact

The vulnerability allows for arbitrary file uploads, which could be exploited to execute malicious code on the server.

Remediation

Users are advised to update the Aiomatic WordPress plugin to version 2.3.9 or later.