WP Remote Thumbnail Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing unrestricted upload of files with dangerous types has been identified in the WP Remote Thumbnail WordPress plugin, affecting versions through 1.3.2. This vulnerability could be exploited to upload a web shell to the server.

Impact

Exploitation of this vulnerability could lead to arbitrary file upload, allowing attackers to upload malicious files such as web shells, which could then be executed to gain further access to the website.

Remediation

Patchstack has issued a virtual patch to block attacks targeting this vulnerability until an official fix is available. WordPress site owners can activate this virtual patch through Patchstack.