Blog2Social WordPress Plugin Limited File Upload Vulnerability

A file upload vulnerability has been identified in the Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress, affecting all versions through 8.6.0. The issue arises from an improper capability check in the uploadVideo() function, which allows authenticated users with Subscriber-level access and higher to upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, allowing for potential execution of malicious files or other security breaches.

Remediation

Users can update to version 8.6.1 or a newer patched version to address this vulnerability.