Astra Security Suite WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Astra Security Suite – Firewall & Malware Scan plugin for WordPress, affecting all versions through 0.2. This issue arises from inadequate validation of remote URLs for zip downloads, combined with an easily guessable key, which enables unauthenticated attackers to upload arbitrary files to the affected site's server. Such uploads could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

No known patch is available for this vulnerability. It is recommended to review the vulnerability details thoroughly and consider uninstalling the affected plugin.