Goza Nonprofit Charity WordPress Theme Missing Authorization Vulnerability Allowing Unauthenticated Arbitrary File Upload

A vulnerability exists in the Goza - Nonprofit Charity WordPress Theme, all versions through 3.2.2, allowing unauthorized arbitrary file uploads. This issue arises from a missing capability check in the 'beplus_import_pack_install_plugin' function. As a result, unauthenticated attackers can upload zip files containing web shells disguised as plugins, enabling remote code execution.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads, which can be used to execute malicious code on the server.

Remediation

Users are advised to update to version 3.2.3 or a newer patched version.