Mail Mint WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Mail Mint plugin for WordPress, affecting all versions through 1.18.10. The issue arises from inadequate file type validation in the process_contact_attribute_import function. This vulnerability enables authenticated attackers with Administrator-level access and above to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

Users are advised to update the Mail Mint plugin to version 1.18.11 or a newer patched version.