Listeo Core WordPress Plugin Unauthenticated Arbitrary Media Upload Vulnerability

A vulnerability exists in the Listeo Core plugin for WordPress, allowing unauthenticated users to upload arbitrary media to the site's media library. This issue affects all versions of the plugin up to and including 2.0.27. The vulnerability arises from the 'listeo_core_handle_dropped_media' function, which lacks proper authorization and capability checks on the AJAX endpoint responsible for file uploads. As a result, unauthorized attackers can exploit this flaw to upload files without executing code directly.

Impact

Exploitation of this vulnerability could lead to unauthorized media uploads, potentially allowing for the later execution of malicious code if the uploaded files are of a type that can be executed.

Remediation

Users are advised to update the Listeo Core plugin to version 2.0.28 or a newer patched version.