Groundhogg WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Groundhogg WordPress plugin, specifically in versions through 3.7.3.5. This issue arises from inadequate file type validation in the 'gh_big_file_upload' function. As a result, authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, which may be used to execute malicious code on the server.

Reproduction

The vulnerability can be reproduced by an authenticated user with Author-level access or higher. After uploading a file through the 'big_file_upload' AJAX action, the file will be saved on the server without proper validation, allowing for potentially harmful files to be uploaded and executed.

Remediation

Users are advised to update the Groundhogg WordPress plugin to version 3.7.3.6 or later.