WordPress Auto Thumbnailer Plugin Arbitrary File Upload Vulnerability
Vulnerability
A vulnerability exists in the Auto Thumbnailer plugin for WordPress, allowing authenticated users with Contributor-level access and above to upload arbitrary files. This issue arises from inadequate file type validation in the uploadThumb() function, present in all versions up to and including 1.0. The vulnerability could potentially lead to remote code execution on the affected site's server.
Impact
Exploitation of this vulnerability could result in unauthorized file uploads, with the potential for remote code execution on the affected server.
Remediation
No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.