Elastic Theme Editor WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Elastic Theme Editor plugin for WordPress, affecting all versions through 0.0.3. This issue arises from a dynamic code generation feature in the 'process_theme' function, which enables authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server. Such uploads could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

There is no known patch available for this vulnerability. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.