Redirection for Contact Form 7 WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability exists in the Redirection for Contact Form 7 WordPress plugin, specifically in versions through 3.2.7. The issue arises from inadequate file type validation in the 'move_file_to_upload' function, allowing unauthenticated users to upload arbitrary files to the server. If 'allow_url_fopen' is enabled, remote files can also be uploaded.

Impact

Exploitation of this vulnerability could lead to unauthorized file uploads, potentially allowing for the execution of malicious files on the server.

Remediation

Users are advised to update the Redirection for Contact Form 7 plugin to version 3.2.8 or later.