WordPress Starter Templates Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file upload has been identified in the Starter Templates plugin for WordPress, affecting all versions through 4.4.41. The issue arises from inadequate validation of file types, particularly WXR files, which allows double extension files to evade proper sanitization and be accepted as legitimate WXR files. This flaw enables authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

Users are advised to update the Starter Templates plugin to version 4.4.42 or a newer patched version.