Embed PDF for WPForms Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Embed PDF for WPForms plugin for WordPress, affecting all versions through 1.1.5. The issue arises from inadequate file type validation in the 'ajax_handler_download_pdf_media' function. This vulnerability enables authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the possibility of executing uploaded files as code, depending on the file type and server configuration.

Remediation

Users are advised to update the Embed PDF for WPForms plugin to version 1.1.6 or a newer patched version.