Zegen Core WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Arbitrary File Upload

A Cross-Site Request Forgery (CSRF) vulnerability allowing arbitrary file upload has been identified in the Zegen Core plugin for WordPress, affecting versions 2.0.1 and prior. The vulnerability arises from inadequate nonce validation and a lack of proper file type validation in the 'custom-font-code/custom-fonts-uploads.php' file. This flaw enables unauthenticated attackers to upload arbitrary files to the affected site's server. Such uploaded files could potentially be used for remote code execution if an attacker can manipulate a site administrator into clicking a link or performing a specific action.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, with the potential for remote code execution if the uploaded file is executed on the server.

Remediation

Users are advised to update the Zegen Core WordPress plugin to version 2.0.2 or a later patched version.