Infility Global WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Infility Global plugin for WordPress, affecting all versions through 2.14.23. The issue arises from inadequate file type validation and missing capability checks. The vulnerability allows authenticated attackers with subscriber-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution if the uploaded files are executed on the server.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.