AIO Forms WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the AIO Forms – Craft Complex Forms Easily plugin for WordPress, affecting all versions through 1.3.15. The issue arises from inadequate file type validation in the import feature, which enables authenticated attackers with Administrator-level access to upload arbitrary files to the server. This vulnerability could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution, depending on the nature of the uploaded files.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.