NotFound Fancy Product Designer Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in the NotFound Fancy Product Designer WordPress plugin, affecting versions through 6.4.3. This arbitrary file upload vulnerability could enable a malicious actor to upload any type of file, including potentially harmful files like backdoors, which could be executed to gain further access to the website.

Impact

Exploitation of this vulnerability could lead to arbitrary file upload, allowing for the introduction of malicious files that could be executed on the server, potentially leading to a full compromise of the website.

Remediation

Users of the NotFound Fancy Product Designer WordPress plugin should update to version 6.4.4 or later. Patchstack users can enable auto-update for vulnerable plugins.