Woffice Core WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Woffice Core plugin for WordPress, which is also used by the Woffice Theme. This issue arises from inadequate file type validation in the 'saveFeaturedImage' function, affecting all versions up to and including 5.4.21. The vulnerability allows authenticated attackers with Subscriber-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, which may be used to execute malicious code on the server.

Remediation

Users are advised to update the Woffice Core plugin to version 5.4.22 or later.