Enable SVG, WebP, and ICO Upload WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file upload has been identified in the Enable SVG, WebP, and ICO Upload plugin for WordPress, affecting all versions through 1.1.2. The issue arises from inadequate validation of file types, particularly ICO files. This flaw enables authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file upload, with the potential for remote code execution on the affected server.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and consider a replacement.