WP移行専用プラグイン for CPI Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the WP移行専用プラグイン for CPI WordPress plugin, affecting all versions through 1.0.2. The issue arises from inadequate file type validation in the Cpiwm_Import_Controller::import function, enabling unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.